CVE-2017-17664

Published: Dec 13, 2017Modified: May 13, 2026

5.9

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

A Remote Crash issue was discovered in Asterisk Open Source 13.x before 13.18.4, 14.x before 14.7.4, and 15.x before 15.1.4 and Certified Asterisk before 13.13-cert9. Certain compound RTCP packets cause a crash in the RTCP Stack.

Affected (16)

Products: Digium: Asterisk, Certified Asterisk

2 products

Certified Asterisk

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Digium Asterisk	From 13.0.0 to 13.18.4
Digium Asterisk	From 14.0.0 to 14.7.4
Digium Asterisk	From 15.0.0 to 15.1.4

Configuration B

13 vulnerable

Vulnerable Software	Affected Versions
Digium Certified Asterisk	Up to 13.13
Digium Certified Asterisk	Version 13.13 cert1
Digium Certified Asterisk	Version 13.13 cert1_rc1
Digium Certified Asterisk	Version 13.13 cert1_rc2
Digium Certified Asterisk	Version 13.13 cert1_rc3
Digium Certified Asterisk	Version 13.13 cert1_rc4
Digium Certified Asterisk	Version 13.13 cert2
Digium Certified Asterisk	Version 13.13 cert3
Digium Certified Asterisk	Version 13.13 cert4
Digium Certified Asterisk	Version 13.13 cert5
Digium Certified Asterisk	Version 13.13 cert6
Digium Certified Asterisk	Version 13.13 cert7
Digium Certified Asterisk	Version 13.13 cert8

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (12)

http://downloads.digium.com/pub/security/AST-2017-012.html

Source: cve@mitre.org

Vendor Advisory

http://www.securityfocus.com/bid/102201

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1040009

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://issues.asterisk.org/jira/browse/ASTERISK-27382

Source: cve@mitre.org

Issue TrackingPatchVendor Advisory

https://issues.asterisk.org/jira/browse/ASTERISK-27429

Source: cve@mitre.org

Issue TrackingVendor Advisory

https://www.debian.org/security/2017/dsa-4076

Source: cve@mitre.org

Third Party Advisory

http://downloads.digium.com/pub/security/AST-2017-012.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securityfocus.com/bid/102201

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1040009

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://issues.asterisk.org/jira/browse/ASTERISK-27382

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchVendor Advisory

https://issues.asterisk.org/jira/browse/ASTERISK-27429

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://www.debian.org/security/2017/dsa-4076

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.