Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2018-17281
HistorySep 24, 2018 - 10:29 p.m.

CVE-2018-17281

2018-09-2422:29:01
CWE-400
[email protected]
web.nvd.nist.gov
1

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.659 Medium

EPSS

Percentile

97.9%

JSON

There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.

Affected configurations

NVD
Node
digiumasteriskRange13.0.0–13.23.0lts
OR
digiumasteriskRange14.0.0–14.7.7
OR
digiumasteriskRange15.0.0–15.6.0standard
Node
digiumcertified_asteriskMatch11.6cert12lts
OR
digiumcertified_asteriskMatch11.6cert13lts
OR
digiumcertified_asteriskMatch11.6cert14lts
OR
digiumcertified_asteriskMatch11.6cert15lts
OR
digiumcertified_asteriskMatch11.6cert16lts
OR
digiumcertified_asteriskMatch11.6cert17lts
OR
digiumcertified_asteriskMatch11.6cert18lts
OR
digiumcertified_asteriskMatch13.1cert3lts
OR
digiumcertified_asteriskMatch13.1cert4lts
OR
digiumcertified_asteriskMatch13.1cert5lts
OR
digiumcertified_asteriskMatch13.1cert6lts
OR
digiumcertified_asteriskMatch13.1cert7lts
OR
digiumcertified_asteriskMatch13.1cert8lts
OR
digiumcertified_asteriskMatch13.8cert1lts
OR
digiumcertified_asteriskMatch13.8cert2lts
OR
digiumcertified_asteriskMatch13.8cert3lts
OR
digiumcertified_asteriskMatch13.8cert4lts
OR
digiumcertified_asteriskMatch13.13cert1lts
OR
digiumcertified_asteriskMatch13.13cert2lts
OR
digiumcertified_asteriskMatch13.13cert3lts
OR
digiumcertified_asteriskMatch13.13cert4lts
OR
digiumcertified_asteriskMatch13.13cert5lts
OR
digiumcertified_asteriskMatch13.13cert6lts
OR
digiumcertified_asteriskMatch13.13cert7lts
OR
digiumcertified_asteriskMatch13.13cert8lts
OR
digiumcertified_asteriskMatch13.13cert9lts
OR
digiumcertified_asteriskMatch13.21cert1lts
OR
digiumcertified_asteriskMatch13.21cert2lts
Node
debiandebian_linuxMatch8.0
OR
debiandebian_linuxMatch9.0

Related

nessus 5
cvelist 1
checkpoint_advisories 1
osv 3
debian 2
freebsd 1
prion 1
openvas 3
ubuntucve 1
debiancve 1
cve 1
gentoo 1
nessus
nessus
Asterisk 13.x < 13.23.1 / 14.x < 14.7.8 / 15.x < 15.6.1 / 13.21 < 13.21-cert3 HTTP Websocket Stack Overflow (AST-2018-009)
2018-09-27 00:00:00
FreeBSD : asterisk -- Remote crash vulnerability in HTTP websocket upgrade (77f67b46-bd75-11e8-81b6-001999f8d30b)
2018-09-24 00:00:00
Debian DLA-1523-1 : asterisk security update
2018-09-28 00:00:00
cvelist
cvelist
CVE-2018-17281
2018-09-24 22:00:00
checkpoint_advisories
checkpoint_advisories
Digium Asterisk res_http_websocket Denial of Service (CVE-2018-17281)
2020-03-08 00:00:00
osv
osv
asterisk - security update
2018-09-27 00:00:00
CVE-2018-17281
2018-09-24 22:29:01
asterisk - security update
2018-10-16 00:00:00
debian
debian
[SECURITY] [DLA 1523-1] asterisk security update
2018-09-27 13:36:41
[SECURITY] [DSA 4320-1] asterisk security update
2018-10-16 21:54:17
freebsd
freebsd
asterisk -- Remote crash vulnerability in HTTP websocket upgrade
2018-08-16 00:00:00
prion
prion
Stack overflow
2018-09-24 22:29:00
openvas
openvas
Asterisk DoS Vulnerability (AST-2018-009)
2018-09-21 00:00:00
Debian: Security Advisory (DLA-1523-1)
2018-09-27 00:00:00
Debian: Security Advisory (DSA-4320-1)
2018-10-15 00:00:00
ubuntucve
ubuntucve
CVE-2018-17281
2018-09-24 00:00:00
debiancve
debiancve
CVE-2018-17281
2018-09-24 22:29:01
cve
cve
CVE-2018-17281
2018-09-24 22:29:01
gentoo
gentoo
Asterisk: Multiple vulnerabilities
2018-11-24 00:00:00

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.659 Medium

EPSS

Percentile

97.9%

JSON
Related for NVD:CVE-2018-17281
nessus5cvelist1checkpoint_advisories1osv3debian2freebsd1prion1openvas3ubuntucve1debiancve1cve1gentoo1