CVE-2017-14098: Input Validation
Published Sep 2, 2017
·Updated
In the pjsip channel driver (respjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel URI in a From, To, or Contact header could cause Asterisk to crash.
Affected Software
87 affected components
Asterisk=13.0.0
Asterisk=13.0.0-beta1
Asterisk=13.0.0-beta2
Asterisk=13.0.0-beta3
Asterisk=13.0.1
Asterisk=13.0.2
Asterisk=13.1.0
Asterisk=13.1.0-rc1
Asterisk=13.1.0-rc2
Asterisk=13.1.1
Asterisk=13.2.0
Asterisk=13.2.0-rc1
Asterisk=13.2.1
Asterisk=13.3.0-rc1
Asterisk=13.3.2
Asterisk=13.4.0
Asterisk=13.4.0-rc1
Asterisk=13.5.0
Asterisk=13.5.0-rc1
Asterisk=13.6.0-rc1
Asterisk=13.7.0-rc1
Asterisk=13.7.0-rc2
Asterisk=13.7.1
Asterisk=13.7.2
Asterisk=13.8.0
Asterisk=13.8.0-rc1
Asterisk=13.8.1
Asterisk=13.8.2
Asterisk=13.9.0
Asterisk=13.9.1
Asterisk=13.10.0
Asterisk=13.10.0-rc1
Asterisk=13.11.0
Asterisk=13.11.1
Asterisk=13.11.2
Asterisk=13.12
Asterisk=13.12.0
Asterisk=13.12.1
Asterisk=13.12.2
Asterisk=13.13
Asterisk=13.13.0
Asterisk=13.13.1
Asterisk=13.14.0
Asterisk=13.14.0-rc1
Asterisk=13.14.0-rc2
Asterisk=13.14.1
Asterisk=13.15.0
Asterisk=13.15.0-rc1
Asterisk=13.15.0-rc2
Asterisk=13.15.0-rc3
Asterisk=13.15.1
Asterisk=13.16.0
Asterisk=13.16.0-rc1
Asterisk=13.16.0-rc2
Asterisk=13.17.0
Asterisk=13.17.0-rc1
Asterisk=14.0
Asterisk=14.0.0
Asterisk=14.0.0-beta1
Asterisk=14.0.0-beta2
Asterisk=14.0.0-rc1
Asterisk=14.0.0-rc2
Asterisk=14.0.1
Asterisk=14.0.2
Asterisk=14.1
Asterisk=14.01
Asterisk=14.1.0
Asterisk=14.1.1
Asterisk=14.1.2
Asterisk=14.02
Asterisk=14.2
Asterisk=14.2.0
Asterisk=14.2.1
Asterisk=14.3.0
Asterisk=14.3.0-rc1
Asterisk=14.3.0-rc2
Asterisk=14.3.1
Asterisk=14.4.0
Asterisk=14.4.0-rc1
Asterisk=14.4.0-rc2
Asterisk=14.4.0-rc3
Asterisk=14.4.1
Asterisk=14.5.0
Asterisk=14.5.0-rc1
Asterisk=14.5.0-rc2
Asterisk=14.6.0
Asterisk=14.6.0-rc1
Remediation
Patch Available
Patch Available
Event History
Sep 2, 2017
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-14098?
CVE-2017-14098 has a severity rating that indicates it can lead to a crash of the Asterisk application.
2
How do I fix CVE-2017-14098?
To fix CVE-2017-14098, update Asterisk to version 13.17.1 or later or 14.6.1 or later.
3
What software versions are affected by CVE-2017-14098?
CVE-2017-14098 affects Asterisk versions 13.x before 13.17.1 and 14.x before 14.6.1.
4
What type of vulnerability is CVE-2017-14098?
CVE-2017-14098 is a denial-of-service vulnerability that can crash the Asterisk server.
5
Is there a workaround for CVE-2017-14098?
There is no known workaround for CVE-2017-14098; the only resolution is to upgrade to the patched versions.