Lucene search

K
freebsdFreeBSDBE261737-C535-11E7-8DA5-001999F8D30B
HistoryOct 15, 2017 - 12:00 a.m.

asterisk -- Memory/File Descriptor/RTP leak in pjsip session resource

2017-10-1500:00:00
vuxml.freebsd.org
51

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.021 Low

EPSS

Percentile

89.1%

The Asterisk project reports:

A memory leak occurs when an Asterisk pjsip session
object is created and that call gets rejected before the
session itself is fully established. When this happens
the session object never gets destroyed. This then leads
to file descriptors and RTP ports being leaked as well.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchasterisk13= 13.5.0UNKNOWN
FreeBSDanynoarchasterisk13< 13.18.1UNKNOWN

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.021 Low

EPSS

Percentile

89.1%