PT-2017-14705 · Sangoma · Asterisk

Juan Sacco · Published 2017-12-02 · Updated 2019-10-03 · CVE-2017-17090

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 13.18.2 and older Asterisk Open Source versions 14.7.2 and older Asterisk Open Source versions 15.1.2 and older Certified Asterisk versions 13.13-cert7 and older

Description An issue in the chan skinny.c file can cause the asterisk process to use excessive virtual memory if the chan skinny channel driver is flooded with certain requests, eventually stopping asterisk from processing any requests.

Recommendations For Asterisk Open Source versions 13.18.2 and older, update to a version newer than 13.18.2 to resolve the issue. For Asterisk Open Source versions 14.7.2 and older, update to a version newer than 14.7.2 to resolve the issue. For Asterisk Open Source versions 15.1.2 and older, update to a version newer than 15.1.2 to resolve the issue. For Certified Asterisk versions 13.13-cert7 and older, update to a version newer than 13.13-cert7 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-459

Related Identifiers

CVE-2017-17090

DLA-1225-1

DSA-4076-1

Affected Products

Asterisk

References · 23

• 🔥 https://exploit-db.com/exploits/43992 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-17090 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4076-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16672 · Security Note
• http://downloads.digium.com/pub/security/AST-2017-013.html · Vendor Advisory
• https://debian.org/security/2017/dsa-4076 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/asterisk · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17090 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-17090 · Security Note
• https://osv.dev/vulnerability/CVE-2017-17090 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-17090 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-17090 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-4076-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17090 · Security Note
• https://issues.asterisk.org/jira/browse/ASTERISK-27452 · Vendor Advisory