exploit the possibilities

Asterisk Project Security Advisory - AST-2017-013

Asterisk Project Security Advisory - AST-2017-013
Posted Dec 4, 2017
Authored by Juan Sacco | Site asterisk.org

Asterisk Project Security Advisory - If the chan_skinny (AKA SCCP protocol) channel driver is flooded with certain requests it can cause the asterisk process to use excessive amounts of virtual memory eventually causing asterisk to stop processing requests of any kind.

tags | advisory, protocol
MD5 | 2cbedc51743649be0104f9790f0c2743

Asterisk Project Security Advisory - AST-2017-013

Change Mirror Download
               Asterisk Project Security Advisory - AST-2017-013

Product Asterisk
Summary DOS Vulnerability in Asterisk chan_skinny
Nature of Advisory Denial of Service
Susceptibility Remote Unauthenticated Sessions
Severity Moderate
Exploits Known Yes
Reported On November 30, 2017
Reported By Juan Sacco
Posted On December 1, 2017
Last Updated On December 1, 2017
Advisory Contact gjoseph AT digium DOT com
CVE Name

Description If the chan_skinny (AKA SCCP protocol) channel driver is
flooded with certain requests it can cause the asterisk
process to use excessive amounts of virtual memory
eventually causing asterisk to stop processing requests of
any kind.

Resolution The chan_skinny driver has been updated to release memory
allocations in a correct manner thereby preventing any
possiblity of exhaustion.

Affected Versions
Product Release Series
Asterisk Open Source 13.x All Versions
Asterisk Open Source 14.x All Versions
Asterisk Open Source 15.x All Versions
Certified Asterisk 13.13 All Versions

Corrected In
Product Release
Asterisk Open Source 13.18.3, 14.7.3, 15.1.3
Certified Asterisk 13.13-cert8

Patches
SVN URL Revision
http://downloads.asterisk.org/pub/security/AST-2017-013-13.diff Asterisk
13
http://downloads.asterisk.org/pub/security/AST-2017-013-14.diff Asterisk
14
http://downloads.asterisk.org/pub/security/AST-2017-013-15.diff Asterisk
15
http://downloads.asterisk.org/pub/security/AST-2017-013-13.13.diff Certified
Asterisk
13.13

Links https://issues.asterisk.org/jira/browse/ASTERISK-27452

Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2017-013.pdf and
http://downloads.digium.com/pub/security/AST-2017-013.html

Revision History
Date Editor Revisions Made
November 30, 2017 George Joseph Initial Revision

Asterisk Project Security Advisory - AST-2017-013
Copyright A(c) 2017 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.

Login or Register to add favorites

File Archive:

January 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    4 Files
  • 2
    Jan 2nd
    3 Files
  • 3
    Jan 3rd
    3 Files
  • 4
    Jan 4th
    33 Files
  • 5
    Jan 5th
    31 Files
  • 6
    Jan 6th
    21 Files
  • 7
    Jan 7th
    15 Files
  • 8
    Jan 8th
    19 Files
  • 9
    Jan 9th
    1 Files
  • 10
    Jan 10th
    1 Files
  • 11
    Jan 11th
    33 Files
  • 12
    Jan 12th
    19 Files
  • 13
    Jan 13th
    27 Files
  • 14
    Jan 14th
    8 Files
  • 15
    Jan 15th
    16 Files
  • 16
    Jan 16th
    0 Files
  • 17
    Jan 17th
    0 Files
  • 18
    Jan 18th
    0 Files
  • 19
    Jan 19th
    0 Files
  • 20
    Jan 20th
    0 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close