← Back

CVE-2018-17281

nvd nist
Published: Sep 24, 2018Modified: Nov 21, 2024

JSON object

Loading...
7.5
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.

Affected (33)

Digium
2 products
Asterisk
Certified Asterisk
Debian
1 product
Debian Linux
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Digium
Asterisk
From 14.0.0 to 14.7.7
Asterisk
From 13.0.0 to 13.23.0
Asterisk
From 15.0.0 to 15.6.0
Configuration B
28 vulnerable
Vulnerable SoftwareAffected Versions
Digium
Certified Asterisk
Version 11.6 cert12
Certified Asterisk
Version 11.6 cert13
Certified Asterisk
Version 11.6 cert14
Certified Asterisk
Version 11.6 cert15
Certified Asterisk
Version 11.6 cert16
Certified Asterisk
Version 11.6 cert17
Certified Asterisk
Version 11.6 cert18
Certified Asterisk
Version 13.13 cert1
Certified Asterisk
Version 13.13 cert2
Certified Asterisk
Version 13.13 cert3
Certified Asterisk
Version 13.13 cert4
Certified Asterisk
Version 13.13 cert5
Certified Asterisk
Version 13.13 cert6
Certified Asterisk
Version 13.13 cert7
Certified Asterisk
Version 13.13 cert8
Certified Asterisk
Version 13.13 cert9
Certified Asterisk
Version 13.1 cert3
Certified Asterisk
Version 13.1 cert4
Certified Asterisk
Version 13.1 cert5
Certified Asterisk
Version 13.1 cert6
Certified Asterisk
Version 13.1 cert7
Certified Asterisk
Version 13.1 cert8
Certified Asterisk
Version 13.21 cert1
Certified Asterisk
Version 13.21 cert2
Certified Asterisk
Version 13.8 cert1
Certified Asterisk
Version 13.8 cert2
Certified Asterisk
Version 13.8 cert3
Certified Asterisk
Version 13.8 cert4
Configuration C
2 vulnerable
Vulnerable SoftwareAffected Versions
Debian
Debian Linux
Version 8.0
Debian Linux
Version 9.0

Related CWEs

CWE-400
Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (20)

Source: cve@mitre.org
PatchVendor Advisory
Source: cve@mitre.org
Third Party AdvisoryVDB Entry
Source: cve@mitre.org
Mailing ListPatchThird Party Advisory
Source: cve@mitre.org
Third Party AdvisoryVDB Entry
Source: cve@mitre.org
Third Party AdvisoryVDB Entry
Source: cve@mitre.org
Issue TrackingThird Party Advisory
Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Mailing ListPatchThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.