7.5
CVE-2021-26717
- EPSS 2.18%
- Veröffentlicht 18.02.2021 20:15:12
- Zuletzt bearbeitet 21.11.2024 05:56:44
- Erkennungen
LoginAn issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When re-negotiating for T.38, if the initial remote response was delayed just enough, Asterisk would send both audio and T.38 in the SDP. If this happened, and the remote responded with a declined T.38 stream, then Asterisk would crash.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Digium ≫ Certified Asterisk Version 16.8 Update -
Digium ≫ Certified Asterisk Version 16.8 Update cert1-rc1
Digium ≫ Certified Asterisk Version 16.8 Update cert1-rc2
Digium ≫ Certified Asterisk Version 16.8 Update cert1-rc3
Digium ≫ Certified Asterisk Version 16.8 Update cert1-rc4
Digium ≫ Certified Asterisk Version 16.8 Update cert2
Digium ≫ Certified Asterisk Version 16.8 Update cert3
Digium ≫ Certified Asterisk Version 16.8 Update cert4
Digium ≫ Certified Asterisk Version 16.8 Update cert4-rc1
Digium ≫ Certified Asterisk Version 16.8 Update cert4-rc2
Digium ≫ Certified Asterisk Version 16.8 Update cert4-rc3
Digium ≫ Certified Asterisk Version 16.8 Update cert4-rc4
Digium ≫ Certified Asterisk Version 16.8 Update cert5
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 2.18% | 0.8 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| NIST | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:N/A:P
|
http://packetstormsecurity.com/files/161471/Asterisk-Project-Security-Advisory-AST-2021-002.html
http://seclists.org/fulldisclosure/2021/Feb/58
https://downloads.asterisk.org/pub/security/
https://downloads.asterisk.org/pub/security/AST-2021-002.html
https://issues.asterisk.org/jira/browse/ASTERISK-29203