CVE-2017-14603

Published: Oct 10, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2 and Certified Asterisk 11.x before 11.6-cert18 and 13.x before 13.13-cert6, insufficient RTCP packet validation could allow reading stale buffer contents and when combined with the "nat" and "symmetric_rtp" options allow redirecting where Asterisk sends the next RTCP report.

Affected (189)

Products: Digium: Asterisk, Certified Asterisk

Digium

2 products

Asterisk

Certified Asterisk

Configuration A

56 vulnerable

Vulnerable Software	Affected Versions
Digium Asterisk	Version 13.0.0
Digium Asterisk	Version 13.0.0 beta1
Digium Asterisk	Version 13.0.0 beta2
Digium Asterisk	Version 13.0.0 beta3
Digium Asterisk	Version 13.0.1
Digium Asterisk	Version 13.0.2
Digium Asterisk	Version 13.1.0
Digium Asterisk	Version 13.1.0 rc1
Digium Asterisk	Version 13.1.0 rc2
Digium Asterisk	Version 13.1.1
Digium Asterisk	Version 13.10.0
Digium Asterisk	Version 13.10.0 rc1
Digium Asterisk	Version 13.11.0
Digium Asterisk	Version 13.11.1
Digium Asterisk	Version 13.11.2
Digium Asterisk	Version 13.12.0
Digium Asterisk	Version 13.12.1
Digium Asterisk	Version 13.12.2
Digium Asterisk	Version 13.12
Digium Asterisk	Version 13.13.0
Digium Asterisk	Version 13.13.1
Digium Asterisk	Version 13.13
Digium Asterisk	Version 13.14.0
Digium Asterisk	Version 13.14.0 rc1
Digium Asterisk	Version 13.14.0 rc2
Digium Asterisk	Version 13.14.1
Digium Asterisk	Version 13.15.0
Digium Asterisk	Version 13.15.0 rc1
Digium Asterisk	Version 13.15.0 rc2
Digium Asterisk	Version 13.15.0 rc3
Digium Asterisk	Version 13.15.1
Digium Asterisk	Version 13.16.0
Digium Asterisk	Version 13.16.0 rc1
Digium Asterisk	Version 13.16.0 rc2
Digium Asterisk	Version 13.17.0
Digium Asterisk	Version 13.17.0 rc1
Digium Asterisk	Version 13.2.0
Digium Asterisk	Version 13.2.0 rc1
Digium Asterisk	Version 13.2.1
Digium Asterisk	Version 13.3.0 rc1
Digium Asterisk	Version 13.3.2
Digium Asterisk	Version 13.4.0
Digium Asterisk	Version 13.4.0 rc1
Digium Asterisk	Version 13.5.0
Digium Asterisk	Version 13.5.0 rc1
Digium Asterisk	Version 13.6.0 rc1
Digium Asterisk	Version 13.7.0 rc1
Digium Asterisk	Version 13.7.0 rc2
Digium Asterisk	Version 13.7.1
Digium Asterisk	Version 13.7.2
Digium Asterisk	Version 13.8.0
Digium Asterisk	Version 13.8.0 rc1
Digium Asterisk	Version 13.8.1
Digium Asterisk	Version 13.8.2
Digium Asterisk	Version 13.9.0
Digium Asterisk	Version 13.9.1

Configuration B

31 vulnerable

Vulnerable Software	Affected Versions
Digium Asterisk	Version 14.0.0
Digium Asterisk	Version 14.0.0 beta1
Digium Asterisk	Version 14.0.0 beta2
Digium Asterisk	Version 14.0.0 rc1
Digium Asterisk	Version 14.0.0 rc2
Digium Asterisk	Version 14.0.1
Digium Asterisk	Version 14.0.2
Digium Asterisk	Version 14.01
Digium Asterisk	Version 14.02
Digium Asterisk	Version 14.0
Digium Asterisk	Version 14.1.0
Digium Asterisk	Version 14.1.1
Digium Asterisk	Version 14.1.2
Digium Asterisk	Version 14.1
Digium Asterisk	Version 14.2.0
Digium Asterisk	Version 14.2.1
Digium Asterisk	Version 14.2
Digium Asterisk	Version 14.3.0
Digium Asterisk	Version 14.3.0 rc1
Digium Asterisk	Version 14.3.0 rc2
Digium Asterisk	Version 14.3.1
Digium Asterisk	Version 14.4.0
Digium Asterisk	Version 14.4.0 rc1
Digium Asterisk	Version 14.4.0 rc2
Digium Asterisk	Version 14.4.0 rc3
Digium Asterisk	Version 14.4.1
Digium Asterisk	Version 14.5.0
Digium Asterisk	Version 14.5.0 rc1
Digium Asterisk	Version 14.5.0 rc2
Digium Asterisk	Version 14.6.0
Digium Asterisk	Version 14.6.0 rc1

Configuration C

74 vulnerable

Vulnerable Software	Affected Versions
Digium Asterisk	Version 11.0.0
Digium Asterisk	Version 11.0.0 beta1
Digium Asterisk	Version 11.0.0 beta2
Digium Asterisk	Version 11.0.0 rc1
Digium Asterisk	Version 11.0.0 rc2
Digium Asterisk	Version 11.0.1
Digium Asterisk	Version 11.0.2
Digium Asterisk	Version 11.1.0
Digium Asterisk	Version 11.1.0 rc1
Digium Asterisk	Version 11.1.0 rc2
Digium Asterisk	Version 11.1.0 rc3
Digium Asterisk	Version 11.1.1
Digium Asterisk	Version 11.1.2
Digium Asterisk	Version 11.10.0
Digium Asterisk	Version 11.10.0 rc1
Digium Asterisk	Version 11.10.1
Digium Asterisk	Version 11.10.1 rc1
Digium Asterisk	Version 11.10.2
Digium Asterisk	Version 11.11.0
Digium Asterisk	Version 11.11.0 rc1
Digium Asterisk	Version 11.12.0
Digium Asterisk	Version 11.12.0 rc1
Digium Asterisk	Version 11.12.1
Digium Asterisk	Version 11.13.0
Digium Asterisk	Version 11.13.0 rc1
Digium Asterisk	Version 11.13.1
Digium Asterisk	Version 11.14.0
Digium Asterisk	Version 11.14.0 rc1
Digium Asterisk	Version 11.14.0 rc2
Digium Asterisk	Version 11.14.1
Digium Asterisk	Version 11.14.2
Digium Asterisk	Version 11.15.0 rc1
Digium Asterisk	Version 11.15.0 rc2
Digium Asterisk	Version 11.15.1
Digium Asterisk	Version 11.16.0 rc1
Digium Asterisk	Version 11.17.0 rc1
Digium Asterisk	Version 11.17.1
Digium Asterisk	Version 11.18.0
Digium Asterisk	Version 11.18.0 rc1
Digium Asterisk	Version 11.19.0 rc1
Digium Asterisk	Version 11.2.0 rc1
Digium Asterisk	Version 11.2.1
Digium Asterisk	Version 11.2.2
Digium Asterisk	Version 11.20.0 rc1
Digium Asterisk	Version 11.21.0 rc1
Digium Asterisk	Version 11.21.0 rc2
Digium Asterisk	Version 11.21.1
Digium Asterisk	Version 11.21.2
Digium Asterisk	Version 11.22.0
Digium Asterisk	Version 11.22.0 rc1
Digium Asterisk	Version 11.23.0
Digium Asterisk	Version 11.23.0 rc1
Digium Asterisk	Version 11.23.1
Digium Asterisk	Version 11.24.0
Digium Asterisk	Version 11.24.1
Digium Asterisk	Version 11.25.0
Digium Asterisk	Version 11.25.1
Digium Asterisk	Version 11.4.0 rc4
Digium Asterisk	Version 11.6.0
Digium Asterisk	Version 11.6.0 rc1
Digium Asterisk	Version 11.6.0 rc2
Digium Asterisk	Version 11.6.1
Digium Asterisk	Version 11.7.0
Digium Asterisk	Version 11.7.0 rc1
Digium Asterisk	Version 11.7.0 rc2
Digium Asterisk	Version 11.8.0
Digium Asterisk	Version 11.8.0 rc1
Digium Asterisk	Version 11.8.0 rc2
Digium Asterisk	Version 11.8.0 rc3
Digium Asterisk	Version 11.8.1
Digium Asterisk	Version 11.9.0
Digium Asterisk	Version 11.9.0 rc1
Digium Asterisk	Version 11.9.0 rc2
Digium Asterisk	Version 11.9.0 rc3

Configuration D

20 vulnerable

Vulnerable Software	Affected Versions
Digium Certified Asterisk	Version 11.6 cert10
Digium Certified Asterisk	Version 11.6 cert11
Digium Certified Asterisk	Version 11.6 cert12
Digium Certified Asterisk	Version 11.6 cert13
Digium Certified Asterisk	Version 11.6 cert14
Digium Certified Asterisk	Version 11.6 cert14_rc1
Digium Certified Asterisk	Version 11.6 cert14_rc2
Digium Certified Asterisk	Version 11.6 cert15
Digium Certified Asterisk	Version 11.6 cert16
Digium Certified Asterisk	Version 11.6 cert1
Digium Certified Asterisk	Version 11.6 cert1_rc1
Digium Certified Asterisk	Version 11.6 cert1_rc2
Digium Certified Asterisk	Version 11.6 cert2
Digium Certified Asterisk	Version 11.6 cert3
Digium Certified Asterisk	Version 11.6 cert4
Digium Certified Asterisk	Version 11.6 cert5
Digium Certified Asterisk	Version 11.6 cert6
Digium Certified Asterisk	Version 11.6 cert7
Digium Certified Asterisk	Version 11.6 cert8
Digium Certified Asterisk	Version 11.6 cert9

Configuration E

8 vulnerable

Vulnerable Software	Affected Versions
Digium Certified Asterisk	Version 13.13 cert1
Digium Certified Asterisk	Version 13.13 cert1_rc1
Digium Certified Asterisk	Version 13.13 cert1_rc2
Digium Certified Asterisk	Version 13.13 cert1_rc3
Digium Certified Asterisk	Version 13.13 cert1_rc4
Digium Certified Asterisk	Version 13.13 cert2
Digium Certified Asterisk	Version 13.13 cert3
Digium Certified Asterisk	Version 13.13 cert4