what you don't know can hurt you

Asterisk Project Security Advisory - AST-2017-013

Asterisk Project Security Advisory - AST-2017-013
Posted Dec 4, 2017
Authored by Juan Sacco | Site asterisk.org

Asterisk Project Security Advisory - If the chan_skinny (AKA SCCP protocol) channel driver is flooded with certain requests it can cause the asterisk process to use excessive amounts of virtual memory eventually causing asterisk to stop processing requests of any kind.

tags | advisory, protocol
MD5 | 2cbedc51743649be0104f9790f0c2743

Asterisk Project Security Advisory - AST-2017-013

Change Mirror Download
               Asterisk Project Security Advisory - AST-2017-013

Product Asterisk
Summary DOS Vulnerability in Asterisk chan_skinny
Nature of Advisory Denial of Service
Susceptibility Remote Unauthenticated Sessions
Severity Moderate
Exploits Known Yes
Reported On November 30, 2017
Reported By Juan Sacco
Posted On December 1, 2017
Last Updated On December 1, 2017
Advisory Contact gjoseph AT digium DOT com
CVE Name

Description If the chan_skinny (AKA SCCP protocol) channel driver is
flooded with certain requests it can cause the asterisk
process to use excessive amounts of virtual memory
eventually causing asterisk to stop processing requests of
any kind.

Resolution The chan_skinny driver has been updated to release memory
allocations in a correct manner thereby preventing any
possiblity of exhaustion.

Affected Versions
Product Release Series
Asterisk Open Source 13.x All Versions
Asterisk Open Source 14.x All Versions
Asterisk Open Source 15.x All Versions
Certified Asterisk 13.13 All Versions

Corrected In
Product Release
Asterisk Open Source 13.18.3, 14.7.3, 15.1.3
Certified Asterisk 13.13-cert8

Patches
SVN URL Revision
http://downloads.asterisk.org/pub/security/AST-2017-013-13.diff Asterisk
13
http://downloads.asterisk.org/pub/security/AST-2017-013-14.diff Asterisk
14
http://downloads.asterisk.org/pub/security/AST-2017-013-15.diff Asterisk
15
http://downloads.asterisk.org/pub/security/AST-2017-013-13.13.diff Certified
Asterisk
13.13

Links https://issues.asterisk.org/jira/browse/ASTERISK-27452

Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2017-013.pdf and
http://downloads.digium.com/pub/security/AST-2017-013.html

Revision History
Date Editor Revisions Made
November 30, 2017 George Joseph Initial Revision

Asterisk Project Security Advisory - AST-2017-013
Copyright A(c) 2017 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.

Login or Register to add favorites

File Archive:

June 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    35 Files
  • 2
    Jun 2nd
    14 Files
  • 3
    Jun 3rd
    40 Files
  • 4
    Jun 4th
    22 Files
  • 5
    Jun 5th
    1 Files
  • 6
    Jun 6th
    1 Files
  • 7
    Jun 7th
    19 Files
  • 8
    Jun 8th
    14 Files
  • 9
    Jun 9th
    39 Files
  • 10
    Jun 10th
    20 Files
  • 11
    Jun 11th
    22 Files
  • 12
    Jun 12th
    2 Files
  • 13
    Jun 13th
    1 Files
  • 14
    Jun 14th
    32 Files
  • 15
    Jun 15th
    34 Files
  • 16
    Jun 16th
    9 Files
  • 17
    Jun 17th
    33 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close