7.5

CVE-2017-14098

In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel URI in a From, To, or Contact header could cause Asterisk to crash.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Digium ≫ Asterisk Version 13.0.0 SwEdition lts
Digium ≫ Asterisk Version 13.0.0 Update beta1
Digium ≫ Asterisk Version 13.0.0 Update beta2
Digium ≫ Asterisk Version 13.0.0 Update beta3
Digium ≫ Asterisk Version 13.0.1
Digium ≫ Asterisk Version 13.0.2
Digium ≫ Asterisk Version 13.1.0
Digium ≫ Asterisk Version 13.1.0 Update rc1
Digium ≫ Asterisk Version 13.1.0 Update rc2
Digium ≫ Asterisk Version 13.1.1
Digium ≫ Asterisk Version 13.2.0
Digium ≫ Asterisk Version 13.2.0 Update rc1
Digium ≫ Asterisk Version 13.2.1
Digium ≫ Asterisk Version 13.3.0 Update rc1
Digium ≫ Asterisk Version 13.3.2
Digium ≫ Asterisk Version 13.4.0
Digium ≫ Asterisk Version 13.4.0 Update rc1
Digium ≫ Asterisk Version 13.5.0
Digium ≫ Asterisk Version 13.5.0 Update rc1
Digium ≫ Asterisk Version 13.6.0 Update rc1
Digium ≫ Asterisk Version 13.7.0 Update rc1
Digium ≫ Asterisk Version 13.7.0 Update rc2
Digium ≫ Asterisk Version 13.7.1
Digium ≫ Asterisk Version 13.7.2
Digium ≫ Asterisk Version 13.8.0
Digium ≫ Asterisk Version 13.8.0 Update rc1
Digium ≫ Asterisk Version 13.8.1
Digium ≫ Asterisk Version 13.8.2
Digium ≫ Asterisk Version 13.9.0
Digium ≫ Asterisk Version 13.9.1
Digium ≫ Asterisk Version 13.10.0
Digium ≫ Asterisk Version 13.10.0 Update rc1
Digium ≫ Asterisk Version 13.11.0
Digium ≫ Asterisk Version 13.11.1
Digium ≫ Asterisk Version 13.11.2
Digium ≫ Asterisk Version 13.12
Digium ≫ Asterisk Version 13.12.0
Digium ≫ Asterisk Version 13.12.1
Digium ≫ Asterisk Version 13.12.2
Digium ≫ Asterisk Version 13.13
Digium ≫ Asterisk Version 13.13.0
Digium ≫ Asterisk Version 13.13.1
Digium ≫ Asterisk Version 13.14.0
Digium ≫ Asterisk Version 13.14.0 Update rc1
Digium ≫ Asterisk Version 13.14.0 Update rc2
Digium ≫ Asterisk Version 13.14.1
Digium ≫ Asterisk Version 13.15.0
Digium ≫ Asterisk Version 13.15.0 Update rc1
Digium ≫ Asterisk Version 13.15.0 Update rc2
Digium ≫ Asterisk Version 13.15.0 Update rc3
Digium ≫ Asterisk Version 13.15.1
Digium ≫ Asterisk Version 13.16.0
Digium ≫ Asterisk Version 13.16.0 Update rc1
Digium ≫ Asterisk Version 13.16.0 Update rc2
Digium ≫ Asterisk Version 13.17.0
Digium ≫ Asterisk Version 13.17.0 Update rc1
Digium ≫ Asterisk Version 14.0
Digium ≫ Asterisk Version 14.0.0
Digium ≫ Asterisk Version 14.0.0 Update beta1
Digium ≫ Asterisk Version 14.0.0 Update beta2
Digium ≫ Asterisk Version 14.0.0 Update rc1
Digium ≫ Asterisk Version 14.0.0 Update rc2
Digium ≫ Asterisk Version 14.0.1
Digium ≫ Asterisk Version 14.0.2
Digium ≫ Asterisk Version 14.1
Digium ≫ Asterisk Version 14.01
Digium ≫ Asterisk Version 14.1.0
Digium ≫ Asterisk Version 14.1.1
Digium ≫ Asterisk Version 14.1.2
Digium ≫ Asterisk Version 14.02
Digium ≫ Asterisk Version 14.2
Digium ≫ Asterisk Version 14.2.0
Digium ≫ Asterisk Version 14.2.1
Digium ≫ Asterisk Version 14.3.0
Digium ≫ Asterisk Version 14.3.0 Update rc1
Digium ≫ Asterisk Version 14.3.0 Update rc2
Digium ≫ Asterisk Version 14.3.1
Digium ≫ Asterisk Version 14.4.0
Digium ≫ Asterisk Version 14.4.0 Update rc1
Digium ≫ Asterisk Version 14.4.0 Update rc2
Digium ≫ Asterisk Version 14.4.0 Update rc3
Digium ≫ Asterisk Version 14.4.1
Digium ≫ Asterisk Version 14.5.0
Digium ≫ Asterisk Version 14.5.0 Update rc1
Digium ≫ Asterisk Version 14.5.0 Update rc2
Digium ≫ Asterisk Version 14.6.0
Digium ≫ Asterisk Version 14.6.0 Update rc1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 50.05% 0.988
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://downloads.asterisk.org/pub/security/AST-2017-007.html
Patch
Vendor Advisory
http://www.securityfocus.com/bid/100583
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1039253
Third Party Advisory
VDB Entry
https://bugs.debian.org/873909
Patch
Third Party Advisory
Issue Tracking
https://issues.asterisk.org/jira/browse/ASTERISK-27152
Vendor Advisory
Issue Tracking