CVE-2017-17090 Information

Description

An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older 14.7.2 and older and 15.1.2 and older and Certified Asterisk 13.13-cert7 and older. If the chan_skinny (aka SCCP protocol) channel driver is flooded with certain requests it can cause the asterisk process to use excessive amounts of virtual memory eventually causing asterisk to stop processing requests of any kind.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Reference

http://downloads.digium.com/pub/security/AST-2017-013.html http://www.securityfocus.com/bid/102023 http://www.securitytracker.com/id/1039948 https://issues.asterisk.org/jira/browse/ASTERISK-27452 https://lists.debian.org/debian-lts-announce/2017/12/msg00028.html https://www.debian.org/security/2017/dsa-4076 https://www.exploit-db.com/exploits/43992/

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

NONE

Base Score

HIGH

Base Severity

7.5