Twenty Year Anniversary

Asterisk Project Security Advisory - AST-2017-013

Asterisk Project Security Advisory - AST-2017-013
Posted Dec 4, 2017
Authored by Juan Sacco | Site asterisk.org

Asterisk Project Security Advisory - If the chan_skinny (AKA SCCP protocol) channel driver is flooded with certain requests it can cause the asterisk process to use excessive amounts of virtual memory eventually causing asterisk to stop processing requests of any kind.

tags | advisory, protocol
MD5 | 2cbedc51743649be0104f9790f0c2743

Asterisk Project Security Advisory - AST-2017-013

Change Mirror Download
               Asterisk Project Security Advisory - AST-2017-013

Product Asterisk
Summary DOS Vulnerability in Asterisk chan_skinny
Nature of Advisory Denial of Service
Susceptibility Remote Unauthenticated Sessions
Severity Moderate
Exploits Known Yes
Reported On November 30, 2017
Reported By Juan Sacco
Posted On December 1, 2017
Last Updated On December 1, 2017
Advisory Contact gjoseph AT digium DOT com
CVE Name

Description If the chan_skinny (AKA SCCP protocol) channel driver is
flooded with certain requests it can cause the asterisk
process to use excessive amounts of virtual memory
eventually causing asterisk to stop processing requests of
any kind.

Resolution The chan_skinny driver has been updated to release memory
allocations in a correct manner thereby preventing any
possiblity of exhaustion.

Affected Versions
Product Release Series
Asterisk Open Source 13.x All Versions
Asterisk Open Source 14.x All Versions
Asterisk Open Source 15.x All Versions
Certified Asterisk 13.13 All Versions

Corrected In
Product Release
Asterisk Open Source 13.18.3, 14.7.3, 15.1.3
Certified Asterisk 13.13-cert8

Patches
SVN URL Revision
http://downloads.asterisk.org/pub/security/AST-2017-013-13.diff Asterisk
13
http://downloads.asterisk.org/pub/security/AST-2017-013-14.diff Asterisk
14
http://downloads.asterisk.org/pub/security/AST-2017-013-15.diff Asterisk
15
http://downloads.asterisk.org/pub/security/AST-2017-013-13.13.diff Certified
Asterisk
13.13

Links https://issues.asterisk.org/jira/browse/ASTERISK-27452

Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2017-013.pdf and
http://downloads.digium.com/pub/security/AST-2017-013.html

Revision History
Date Editor Revisions Made
November 30, 2017 George Joseph Initial Revision

Asterisk Project Security Advisory - AST-2017-013
Copyright A(c) 2017 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    10 Files
  • 2
    Nov 2nd
    15 Files
  • 3
    Nov 3rd
    2 Files
  • 4
    Nov 4th
    2 Files
  • 5
    Nov 5th
    32 Files
  • 6
    Nov 6th
    27 Files
  • 7
    Nov 7th
    8 Files
  • 8
    Nov 8th
    9 Files
  • 9
    Nov 9th
    17 Files
  • 10
    Nov 10th
    2 Files
  • 11
    Nov 11th
    2 Files
  • 12
    Nov 12th
    33 Files
  • 13
    Nov 13th
    29 Files
  • 14
    Nov 14th
    23 Files
  • 15
    Nov 15th
    45 Files
  • 16
    Nov 16th
    0 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close