CVE-2017-17850

high-risk
Published 2017-12-27

An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and the PJSIP channel driver was used, Asterisk would crash. The severity of this vulnerability is somewhat mitigated if authentication is enabled. If authentication is enabled, a user would have to first be authorized before reaching the crash point.

Do I need to act?

!
30.0% chance of exploitation in next 30 days
EPSS score — higher than 70% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (5)

Affected Vendors

Digium

References (8)

Vendor Advisory http://downloads.asterisk.org/pub/security/AST-2017-014.html
Third Party Advisory http://www.securitytracker.com/id/1040056
Issue Tracking https://issues.asterisk.org/jira/browse/ASTERISK-27480
https://security.gentoo.org/glsa/201811-11
Vendor Advisory http://downloads.asterisk.org/pub/security/AST-2017-014.html
Third Party Advisory http://www.securitytracker.com/id/1040056
Issue Tracking https://issues.asterisk.org/jira/browse/ASTERISK-27480
https://security.gentoo.org/glsa/201811-11
53
/ 100
high-risk
Severity 26/34 · High
Exploitability 15/34 · Moderate
Exposure 12/34 · Low