CVE-2017-16872

moderate-risk
Published 2017-11-17

An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. Parsing the numeric header fields in a SIP message (like cseq, ttl, port, etc.) all had the potential to overflow, either causing unintended values to be captured or, if the values were subsequently converted back to strings, a buffer overrun. This will lead to a potential exploit using carefully crafted invalid values.

Do I need to act?

-
0.86% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (2)

Affected Vendors

Teluu Debian

References (6)

Release Notes https://trac.pjsip.org/repos/milestone/release-2.7.1
Vendor Advisory https://trac.pjsip.org/repos/ticket/2056
Third Party Advisory https://www.debian.org/security/2018/dsa-4170
Release Notes https://trac.pjsip.org/repos/milestone/release-2.7.1
Vendor Advisory https://trac.pjsip.org/repos/ticket/2056
Third Party Advisory https://www.debian.org/security/2018/dsa-4170
42
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 3/34 · Minimal
Exposure 7/34 · Low