7.5

CVE-2017-9372

PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (buffer overflow and application crash) via a SIP packet with a crafted CSeq header in conjunction with a Via header that lacks a branch parameter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Digium ≫ Open Source Version 13.0.0
Digium ≫ Open Source Version 13.1.0
Digium ≫ Open Source Version 13.1.0 Update rc1
Digium ≫ Open Source Version 13.1.0 Update rc2
Digium ≫ Open Source Version 13.2.0
Digium ≫ Open Source Version 13.2.0 Update rc1
Digium ≫ Open Source Version 13.3.0 Update rc1
Digium ≫ Open Source Version 13.4.0
Digium ≫ Open Source Version 13.4.0 Update rc1
Digium ≫ Open Source Version 13.5.0
Digium ≫ Open Source Version 13.5.0 Update rc1
Digium ≫ Open Source Version 13.6.0 Update rc1
Digium ≫ Open Source Version 13.7.0
Digium ≫ Open Source Version 13.7.0 Update rc1
Digium ≫ Open Source Version 13.8.0
Digium ≫ Open Source Version 13.8.0 Update rc1
Digium ≫ Open Source Version 13.8.1
Digium ≫ Open Source Version 13.8.2
Digium ≫ Open Source Version 13.9.0
Digium ≫ Open Source Version 13.9.0 Update rc1
Digium ≫ Open Source Version 13.10.0 Update rc1
Digium ≫ Open Source Version 13.11.0 Update rc1
Digium ≫ Open Source Version 13.12.0
Digium ≫ Open Source Version 13.12.0 Update rc1
Digium ≫ Open Source Version 13.12.1
Digium ≫ Open Source Version 13.12.2
Digium ≫ Open Source Version 13.13.0 Update rc1
Digium ≫ Open Source Version 13.14.0 Update rc1
Digium ≫ Open Source Version 13.15.0 Update rc1
Digium ≫ Open Source Version 14.0.0
Digium ≫ Open Source Version 14.0.0 Update beta1
Digium ≫ Open Source Version 14.0.0 Update beta2
Digium ≫ Open Source Version 14.0.0 Update rc1
Digium ≫ Open Source Version 14.1.0 Update rc1
Digium ≫ Open Source Version 14.2.0
Digium ≫ Open Source Version 14.2.0 Update rc1
Digium ≫ Open Source Version 14.2.0 Update rc2
Digium ≫ Open Source Version 14.2.1
Digium ≫ Open Source Version 14.3.0 Update rc1
Digium ≫ Open Source Version 14.4.0 Update rc1
Digium ≫ Certified Asterisk Version 13.13.0
Digium ≫ Certified Asterisk Version 13.13.0 Update cert1
Digium ≫ Certified Asterisk Version 13.13.0 Update cert1-rc1
Digium ≫ Certified Asterisk Version 13.13.0 Update cert1-rc2
Digium ≫ Certified Asterisk Version 13.13.0 Update cert1-rc3
Digium ≫ Certified Asterisk Version 13.13.0 Update cert1-rc4
Digium ≫ Certified Asterisk Version 13.13.0 Update cert2
Digium ≫ Certified Asterisk Version 13.13.0 Update cert3
Digium ≫ Certified Asterisk Version 13.13.0 Update rc1
Digium ≫ Certified Asterisk Version 13.13.0 Update rc2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.99% 0.892
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://www.debian.org/security/2017/dsa-3933
http://downloads.asterisk.org/pub/security/AST-2017-002.txt
Third Party Advisory
http://www.securityfocus.com/bid/98572
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1038529
https://bugs.debian.org/863901
Third Party Advisory
Mailing List