PT-2017-14705 · Sangoma · Asterisk

Juan Sacco · Publicado 2017-12-02 · Atualizado 2019-10-03 · CVE-2017-17090

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 13.18.2 and older Asterisk Open Source versions 14.7.2 and older Asterisk Open Source versions 15.1.2 and older Certified Asterisk versions 13.13-cert7 and older

Description An issue in the chan skinny.c file can cause the asterisk process to use excessive virtual memory if the chan skinny channel driver is flooded with certain requests, eventually stopping asterisk from processing any requests.

Recommendations For Asterisk Open Source versions 13.18.2 and older, update to a version newer than 13.18.2 to resolve the issue. For Asterisk Open Source versions 14.7.2 and older, update to a version newer than 14.7.2 to resolve the issue. For Asterisk Open Source versions 15.1.2 and older, update to a version newer than 15.1.2 to resolve the issue. For Certified Asterisk versions 13.13-cert7 and older, update to a version newer than 13.13-cert7 to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-459

Identificadores relacionados

CVE-2017-17090

DLA-1225-1

DSA-4076-1

Produtos afetados

Asterisk

Referências · 23

• 🔥 https://exploit-db.com/exploits/43992 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-17090 · Aviso do Fabricante
• https://packages.debian.org/src:asterisk · Nota
• https://osv.dev/vulnerability/DSA-4076-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16672 · Nota de Segurança
• http://downloads.digium.com/pub/security/AST-2017-013.html · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2017/12/msg00028.html · Nota
• https://debian.org/security/2017/dsa-4076 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/asterisk · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17090 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2017-17090 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-17090 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-17090 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-17090 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DSA-4076-1 · Aviso do Fabricante