PT-2017-14515 · Digium · Asterisk

Corey Farrell + 1 · Published 2017-11-09 · Updated 2019-10-03 · CVE-2017-16672

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions prior to 13.18.1 Asterisk Open Source versions prior to 14.7.1 Asterisk Open Source versions prior to 15.1.1 Certified Asterisk versions prior to 13.13-cert7

Description A memory leak occurs when an Asterisk pjsip session object is created and the call gets rejected before the session is fully established, causing the session object to never be destroyed. This can lead to Asterisk running out of memory and crashing.

Recommendations For Asterisk Open Source versions prior to 13.18.1, update to version 13.18.1 or later. For Asterisk Open Source versions prior to 14.7.1, update to version 14.7.1 or later. For Asterisk Open Source versions prior to 15.1.1, update to version 15.1.1 or later. For Certified Asterisk versions prior to 13.13-cert7, update to version 13.13-cert7 or later.

Fix

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2017-16672

DSA-4076-1

Affected Products

Asterisk

References · 22

• https://osv.dev/vulnerability/DSA-4076-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16672 · Security Note
• https://debian.org/security/2017/dsa-4076 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-16672 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/asterisk · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17090 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-16672 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16672 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16672 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-4076-1 · Vendor Advisory
• https://issues.asterisk.org/jira/browse/ASTERISK-27345 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16672 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16672 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16672 · Security Note
• https://security.gentoo.org/glsa/201811-11 · Vendor Advisory