PT-2017-14944 · Digium · Asterisk

Vitezslav Novy + 1 · Publicado 2017-12-13 · Atualizado 2018-01-02 · CVE-2017-17664

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 13.x before 13.18.4 Asterisk Open Source versions 14.x before 14.7.4 Asterisk Open Source versions 15.x before 15.1.4 Certified Asterisk versions before 13.13-cert9

Description A Remote Crash issue was discovered in certain versions of Asterisk. The issue is caused by certain compound RTCP packets that can cause a crash in the RTCP Stack.

Recommendations For Asterisk Open Source versions 13.x before 13.18.4, update to version 13.18.4 or later. For Asterisk Open Source versions 14.x before 14.7.4, update to version 14.7.4 or later. For Asterisk Open Source versions 15.x before 15.1.4, update to version 15.1.4 or later. For Certified Asterisk versions before 13.13-cert9, update to version 13.13-cert9 or later.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2017-17664

DSA-4076-1

Produtos afetados

Asterisk

Referências · 22

• https://ubuntu.com/security/CVE-2017-17664 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-17664 · Aviso do Fabricante
• https://packages.debian.org/src:asterisk · Nota
• https://osv.dev/vulnerability/DSA-4076-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16672 · Nota de Segurança
• http://downloads.digium.com/pub/security/AST-2017-012.html · Aviso do Fabricante
• https://debian.org/security/2017/dsa-4076 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/asterisk · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-17664 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17090 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-17664 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DSA-4076-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-17664 · Aviso do Fabricante
• https://issues.asterisk.org/jira/browse/ASTERISK-27382 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-17664 · Aviso do Fabricante