PT-2018-18001 · Sangoma · Asterisk

Sean Bright + 1 · Publicado 2018-02-22 · Atualizado 2019-10-03 · CVE-2018-7287

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Asterisk versions 15.x through 15.2.1

Description An issue in the res http websocket.c file causes the Asterisk system to mishandle WebSocket payloads of size 0, resulting in a busy loop when the HTTP server is enabled.

Recommendations For Asterisk versions 15.x through 15.2.1, consider disabling the HTTP server as a temporary workaround to minimize the risk of exploitation.

Correção

Improper Check for Exceptional Conditions

Enumeração de Fraquezas

CWE-754

Identificadores relacionados

CVE-2018-7287

Produtos afetados

Asterisk

Referências · 7

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7287 · Nota
• http://downloads.digium.com/pub/security/AST-2018-006.html · Aviso do Fabricante
• https://issues.asterisk.org/jira/browse/ASTERISK-27658 · Aviso do Fabricante
• http://securitytracker.com/id/1040419 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-7287 · Nota de Segurança
• http://securityfocus.com/bid/103120 · Nota
• https://osv.dev/vulnerability/CVE-2018-7287 · Aviso do Fabricante