Lucene search

MitreCVE-2017-9358

HistoryJun 02, 2017 - 5:29 a.m.

CVE-2017-9358

2017-06-0205:29:00

CWE-835

mitre

web.nvd.nist.gov

vulnerability

memory exhaustion

asterisk open source

sccp packets

infinite loop

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.008

Percentile

82.3%

JSON

A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 and Certified Asterisk 13.13 before 13.13-cert4, which can be triggered by sending specially crafted SCCP packets causing an infinite loop and leading to memory exhaustion (by message logging in that loop).

Affected configurations

Nvd

Node

sangomaasteriskMatch13.0.0

sangomaasteriskMatch13.1.0

sangomaasteriskMatch13.1.0rc1

sangomaasteriskMatch13.1.0rc2

sangomaasteriskMatch13.2.0

sangomaasteriskMatch13.2.0rc1

sangomaasteriskMatch13.3.0rc1

sangomaasteriskMatch13.4.0

sangomaasteriskMatch13.4.0rc1

sangomaasteriskMatch13.5.0

sangomaasteriskMatch13.5.0rc1

sangomaasteriskMatch13.6.0rc1

sangomaasteriskMatch13.7.0

sangomaasteriskMatch13.7.0rc1

sangomaasteriskMatch13.8.0

sangomaasteriskMatch13.8.0rc1

sangomaasteriskMatch13.8.1

sangomaasteriskMatch13.8.2

sangomaasteriskMatch13.9.0

sangomaasteriskMatch13.9.0rc1

sangomaasteriskMatch13.10.0rc1

sangomaasteriskMatch13.11.0rc1

sangomaasteriskMatch13.12.0

sangomaasteriskMatch13.12.0rc1

sangomaasteriskMatch13.12.1

sangomaasteriskMatch13.12.2

sangomaasteriskMatch13.13.0rc1

sangomaasteriskMatch13.14.0rc1

sangomaasteriskMatch13.15.0rc1

Node

asteriskcertified_asteriskMatch13.13.0

asteriskcertified_asteriskMatch13.13.0cert1

asteriskcertified_asteriskMatch13.13.0cert1-rc1

asteriskcertified_asteriskMatch13.13.0cert1-rc2

asteriskcertified_asteriskMatch13.13.0cert1-rc3

asteriskcertified_asteriskMatch13.13.0cert1-rc4

asteriskcertified_asteriskMatch13.13.0cert2

asteriskcertified_asteriskMatch13.13.0cert3

asteriskcertified_asteriskMatch13.13.0rc1

asteriskcertified_asteriskMatch13.13.0rc2

Node

sangomaasteriskMatch14.0.0

sangomaasteriskMatch14.0.0beta1

sangomaasteriskMatch14.0.0beta2

sangomaasteriskMatch14.0.0rc1

sangomaasteriskMatch14.1.0rc1

sangomaasteriskMatch14.2.0

sangomaasteriskMatch14.2.0rc1

sangomaasteriskMatch14.2.0rc2

sangomaasteriskMatch14.2.1

sangomaasteriskMatch14.3.0rc1

sangomaasteriskMatch14.4.0rc1

VendorProductVersionCPE
sangomaasterisk13.0.0cpe:2.3:a:sangoma:asterisk:13.0.0:*:*:*:*:*:*:*
sangomaasterisk13.1.0cpe:2.3:a:sangoma:asterisk:13.1.0:*:*:*:*:*:*:*
sangomaasterisk13.1.0cpe:2.3:a:sangoma:asterisk:13.1.0:rc1:*:*:*:*:*:*
sangomaasterisk13.1.0cpe:2.3:a:sangoma:asterisk:13.1.0:rc2:*:*:*:*:*:*
sangomaasterisk13.2.0cpe:2.3:a:sangoma:asterisk:13.2.0:*:*:*:*:*:*:*
sangomaasterisk13.2.0cpe:2.3:a:sangoma:asterisk:13.2.0:rc1:*:*:*:*:*:*
sangomaasterisk13.3.0cpe:2.3:a:sangoma:asterisk:13.3.0:rc1:*:*:*:*:*:*
sangomaasterisk13.4.0cpe:2.3:a:sangoma:asterisk:13.4.0:*:*:*:*:*:*:*
sangomaasterisk13.4.0cpe:2.3:a:sangoma:asterisk:13.4.0:rc1:*:*:*:*:*:*
sangomaasterisk13.5.0cpe:2.3:a:sangoma:asterisk:13.5.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sangoma	asterisk	13.0.0	cpe:2.3:a:sangoma:asterisk:13.0.0:::::::*
sangoma	asterisk	13.1.0	cpe:2.3:a:sangoma:asterisk:13.1.0:::::::*
sangoma	asterisk	13.1.0	cpe:2.3:a:sangoma:asterisk:13.1.0:rc1::::::
sangoma	asterisk	13.1.0	cpe:2.3:a:sangoma:asterisk:13.1.0:rc2::::::
sangoma	asterisk	13.2.0	cpe:2.3:a:sangoma:asterisk:13.2.0:::::::*
sangoma	asterisk	13.2.0	cpe:2.3:a:sangoma:asterisk:13.2.0:rc1::::::
sangoma	asterisk	13.3.0	cpe:2.3:a:sangoma:asterisk:13.3.0:rc1::::::
sangoma	asterisk	13.4.0	cpe:2.3:a:sangoma:asterisk:13.4.0:::::::*
sangoma	asterisk	13.4.0	cpe:2.3:a:sangoma:asterisk:13.4.0:rc1::::::
sangoma	asterisk	13.5.0	cpe:2.3:a:sangoma:asterisk:13.5.0:::::::*

Rows per page:

1-10 of 501

References

downloads.asterisk.org/pub/security/AST-2017-004.txt

www.securityfocus.com/bid/98573

www.securitytracker.com/id/1038531

bugs.debian.org/863906

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.008

Percentile

82.3%

JSON

Related for CVE-2017-9358