exploit the possibilities

Asterisk Project Security Advisory - AST-2017-013

Asterisk Project Security Advisory - AST-2017-013
Posted Dec 4, 2017
Authored by Juan Sacco | Site asterisk.org

Asterisk Project Security Advisory - If the chan_skinny (AKA SCCP protocol) channel driver is flooded with certain requests it can cause the asterisk process to use excessive amounts of virtual memory eventually causing asterisk to stop processing requests of any kind.

tags | advisory, protocol
MD5 | 2cbedc51743649be0104f9790f0c2743

Asterisk Project Security Advisory - AST-2017-013

Change Mirror Download
               Asterisk Project Security Advisory - AST-2017-013

Product Asterisk
Summary DOS Vulnerability in Asterisk chan_skinny
Nature of Advisory Denial of Service
Susceptibility Remote Unauthenticated Sessions
Severity Moderate
Exploits Known Yes
Reported On November 30, 2017
Reported By Juan Sacco
Posted On December 1, 2017
Last Updated On December 1, 2017
Advisory Contact gjoseph AT digium DOT com
CVE Name

Description If the chan_skinny (AKA SCCP protocol) channel driver is
flooded with certain requests it can cause the asterisk
process to use excessive amounts of virtual memory
eventually causing asterisk to stop processing requests of
any kind.

Resolution The chan_skinny driver has been updated to release memory
allocations in a correct manner thereby preventing any
possiblity of exhaustion.

Affected Versions
Product Release Series
Asterisk Open Source 13.x All Versions
Asterisk Open Source 14.x All Versions
Asterisk Open Source 15.x All Versions
Certified Asterisk 13.13 All Versions

Corrected In
Product Release
Asterisk Open Source 13.18.3, 14.7.3, 15.1.3
Certified Asterisk 13.13-cert8

Patches
SVN URL Revision
http://downloads.asterisk.org/pub/security/AST-2017-013-13.diff Asterisk
13
http://downloads.asterisk.org/pub/security/AST-2017-013-14.diff Asterisk
14
http://downloads.asterisk.org/pub/security/AST-2017-013-15.diff Asterisk
15
http://downloads.asterisk.org/pub/security/AST-2017-013-13.13.diff Certified
Asterisk
13.13

Links https://issues.asterisk.org/jira/browse/ASTERISK-27452

Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2017-013.pdf and
http://downloads.digium.com/pub/security/AST-2017-013.html

Revision History
Date Editor Revisions Made
November 30, 2017 George Joseph Initial Revision

Asterisk Project Security Advisory - AST-2017-013
Copyright A(c) 2017 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.

Login or Register to add favorites

File Archive:

December 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    18 Files
  • 2
    Dec 2nd
    11 Files
  • 3
    Dec 3rd
    23 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    13 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close