8.8

CVE-2017-16671

A Buffer Overflow issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. No size checking is done when setting the user field for Party B on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. NOTE: this is different from CVE-2017-7617, which was only about the Party A buffer.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Digium ≫ Asterisk Version >= 13.0.0 < 13.18.1
Digium ≫ Asterisk Version >= 14.0.0 < 14.7.1
Digium ≫ Asterisk Version >= 15.0.0 < 15.1.1
Digium ≫ Certified Asterisk Version 13.13.0
Digium ≫ Certified Asterisk Version 13.13.0 Update cert1
Digium ≫ Certified Asterisk Version 13.13.0 Update cert1_rc1
Digium ≫ Certified Asterisk Version 13.13.0 Update cert1_rc2
Digium ≫ Certified Asterisk Version 13.13.0 Update cert1_rc3
Digium ≫ Certified Asterisk Version 13.13.0 Update cert1_rc4
Digium ≫ Certified Asterisk Version 13.13.0 Update cert2
Digium ≫ Certified Asterisk Version 13.13.0 Update cert3
Digium ≫ Certified Asterisk Version 13.13.0 Update cert4
Digium ≫ Certified Asterisk Version 13.13.0 Update cert5
Digium ≫ Certified Asterisk Version 13.13.0 Update cert6
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.34% 0.871
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://downloads.digium.com/pub/security/AST-2017-010.html
Vendor Advisory
http://www.securityfocus.com/bid/101760
Third Party Advisory
VDB Entry
https://issues.asterisk.org/jira/browse/ASTERISK-27337
Vendor Advisory
Issue Tracking
https://security.gentoo.org/glsa/201811-11
https://www.debian.org/security/2017/dsa-4076