CVE-2017-17090
First published: Sat Dec 02 2017(Updated: )
An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and older, and Certified Asterisk 13.13-cert7 and older. If the chan_skinny (aka SCCP protocol) channel driver is flooded with certain requests, it can cause the asterisk process to use excessive amounts of virtual memory, eventually causing asterisk to stop processing requests of any kind.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Digium Certified Asterisk | <=13.13 | |
| Digium Certified Asterisk | =13.13-cert1 | |
| Digium Certified Asterisk | =13.13-cert1_rc1 | |
| Digium Certified Asterisk | =13.13-cert1_rc2 | |
| Digium Certified Asterisk | =13.13-cert1_rc3 | |
| Digium Certified Asterisk | =13.13-cert1_rc4 | |
| Digium Certified Asterisk | =13.13-cert2 | |
| Digium Certified Asterisk | =13.13-cert3 | |
| Digium Certified Asterisk | =13.13-cert4 | |
| Digium Certified Asterisk | =13.13-cert5 | |
| Digium Certified Asterisk | =13.13-cert6 | |
| Digium Certified Asterisk | =13.13-cert7 | |
| Digium Asterisk | <=13.8.2 | |
| Digium Asterisk | <=14.7.2 | |
| Digium Asterisk | <=15.1.2 | |
| debian/asterisk | 1:16.2.1~dfsg-1+deb10u2 1:16.28.0~dfsg-0+deb10u3 1:16.28.0~dfsg-0+deb11u3 1:20.4.0~dfsg+~cs6.13.40431414-2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://downloads.digium.com/pub/security/AST-2017-013.html
- http://www.securityfocus.com/bid/102023
- http://www.securitytracker.com/id/1039948
- https://issues.asterisk.org/jira/browse/ASTERISK-27452
- https://lists.debian.org/debian-lts-announce/2017/12/msg00028.html
- https://www.debian.org/security/2017/dsa-4076
- https://www.exploit-db.com/exploits/43992/
- https://security-tracker.debian.org/tracker/CVE-2017-17090
Frequently Asked Questions
What is the severity of CVE-2017-17090?
The severity of CVE-2017-17090 is high.
How does CVE-2017-17090 affect Asterisk Open Source?
CVE-2017-17090 affects Asterisk Open Source versions 13.18.2 and older, 14.7.2 and older, and 15.1.2 and older.
What is the remedy for CVE-2017-17090?
The remedy for CVE-2017-17090 is to update Asterisk Open Source to version 13.13-cert7 and older, or 1:16.2.1~dfsg-1+deb10u2, 1:16.28.0~dfsg-0+deb10u3, 1:16.28.0~dfsg-0+deb11u3, 1:20.4.0~dfsg+~cs6.13.40431414-2 or newer.
Where can I find more information about CVE-2017-17090?
You can find more information about CVE-2017-17090 at the following references: [AST-2017-013](http://downloads.digium.com/pub/security/AST-2017-013.html), [ASTERISK-27452](https://issues.asterisk.org/jira/browse/ASTERISK-27452), [CVE-2017-17090](https://security-tracker.debian.org/tracker/CVE-2017-17090).
What is the Common Weakness Enumeration (CWE) for CVE-2017-17090?
The Common Weakness Enumeration (CWE) for CVE-2017-17090 is CWE-459.
- collector/nvd-index
- collector/security-tracker-debian
- vendor/digium
- canonical/digium certified asterisk
- version/digium certified asterisk/13.13
- version/digium certified asterisk/13.13-cert1
- version/digium certified asterisk/13.13-cert1_rc1
- version/digium certified asterisk/13.13-cert1_rc2
- version/digium certified asterisk/13.13-cert1_rc3
- version/digium certified asterisk/13.13-cert1_rc4
- version/digium certified asterisk/13.13-cert2
- version/digium certified asterisk/13.13-cert3
- version/digium certified asterisk/13.13-cert4
- version/digium certified asterisk/13.13-cert5
- version/digium certified asterisk/13.13-cert6
- version/digium certified asterisk/13.13-cert7
- canonical/digium asterisk
- version/digium asterisk/13.8.2
- version/digium asterisk/14.7.2
- version/digium asterisk/15.1.2
- package-manager/debian