Design/Logic Flaw

2017-12-1320:29:00

PRIOn knowledge base

www.prio-n.com

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

5.7 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.929 High

EPSS

Percentile

99.0%

JSON

A Remote Crash issue was discovered in Asterisk Open Source 13.x before 13.18.4, 14.x before 14.7.4, and 15.x before 15.1.4 and Certified Asterisk before 13.13-cert9. Certain compound RTCP packets cause a crash in the RTCP Stack.

CPENameOperatorVersion
asteriskge15.0.0
asterisklt15.1.4
asteriskge14.0.0
asterisklt14.7.4
asteriskge13.0.0
asterisklt13.18.4
certified_asteriskeq13.13 cert1
certified_asteriskeq13.13 cert1-rc1
certified_asteriskeq13.13 cert1-rc4
certified_asteriskeq13.13 cert1-rc3

Name	Operator	Version
asterisk	ge	15.0.0
asterisk	lt	15.1.4
asterisk	ge	14.0.0
asterisk	lt	14.7.4
asterisk	ge	13.0.0
asterisk	lt	13.18.4
certified_asterisk	eq	13.13 cert1
certified_asterisk	eq	13.13 cert1-rc1
certified_asterisk	eq	13.13 cert1-rc4
certified_asterisk	eq	13.13 cert1-rc3