CVE-2017-9372 PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service...
HighCVSS 7.5
EPSS 4.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (buffer overflow and application crash) via a SIP packet with a crafted CSeq header in conjunction with a Via header that lacks a branch parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| digium open source | = 13.0.0 | No fix listed |
| digium open source | = 13.1.0 | No fix listed |
| digium open source | = 13.1.0-rc1 | No fix listed |
| digium open source | = 13.1.0-rc2 | No fix listed |
| digium open source | = 13.2.0 | No fix listed |
| digium open source | = 13.2.0-rc1 | No fix listed |
| digium open source | = 13.3.0-rc1 | No fix listed |
| digium open source | = 13.4.0 | No fix listed |
| digium open source | = 13.4.0-rc1 | No fix listed |
| digium open source | = 13.5.0 | No fix listed |
| digium open source | = 13.5.0-rc1 | No fix listed |
| digium open source | = 13.6.0-rc1 | No fix listed |
| digium open source | = 13.7.0 | No fix listed |
| digium open source | = 13.7.0-rc1 | No fix listed |
| digium open source | = 13.8.0 | No fix listed |
| digium open source | = 13.8.0-rc1 | No fix listed |
| digium open source | = 13.8.1 | No fix listed |
| digium open source | = 13.8.2 | No fix listed |
| digium open source | = 13.9.0 | No fix listed |
| digium open source | = 13.9.0-rc1 | No fix listed |
| digium open source | = 13.10.0-rc1 | No fix listed |
| digium open source | = 13.11.0-rc1 | No fix listed |
| digium open source | = 13.12.0 | No fix listed |
| digium open source | = 13.12.0-rc1 | No fix listed |
| digium open source | = 13.12.1 | No fix listed |
Show 25 more
| Product | Affected versions | Fixed in |
|---|---|---|
| digium open source | = 13.12.2 | No fix listed |
| digium open source | = 13.13.0-rc1 | No fix listed |
| digium open source | = 13.14.0-rc1 | No fix listed |
| digium open source | = 13.15.0-rc1 | No fix listed |
| digium open source | = 14.0.0 | No fix listed |
| digium open source | = 14.0.0-beta1 | No fix listed |
| digium open source | = 14.0.0-beta2 | No fix listed |
| digium open source | = 14.0.0-rc1 | No fix listed |
| digium open source | = 14.1.0-rc1 | No fix listed |
| digium open source | = 14.2.0 | No fix listed |
| digium open source | = 14.2.0-rc1 | No fix listed |
| digium open source | = 14.2.0-rc2 | No fix listed |
| digium open source | = 14.2.1 | No fix listed |
| digium open source | = 14.3.0-rc1 | No fix listed |
| digium open source | = 14.4.0-rc1 | No fix listed |
| digium certified asterisk | = 13.13.0 | No fix listed |
| digium certified asterisk | = 13.13.0-cert1 | No fix listed |
| digium certified asterisk | = 13.13.0-cert1-rc1 | No fix listed |
| digium certified asterisk | = 13.13.0-cert1-rc2 | No fix listed |
| digium certified asterisk | = 13.13.0-cert1-rc3 | No fix listed |
| digium certified asterisk | = 13.13.0-cert1-rc4 | No fix listed |
| digium certified asterisk | = 13.13.0-cert2 | No fix listed |
| digium certified asterisk | = 13.13.0-cert3 | No fix listed |
| digium certified asterisk | = 13.13.0-rc1 | No fix listed |
| digium certified asterisk | = 13.13.0-rc2 | No fix listed |
References
- downloads.asterisk.org third-party-advisory
- DSA-3933 vendor-advisory
- 98572 third-party-advisory vdb-entry
- 1038529 vdb-entry
- bugs.debian.org mailing-list third-party-advisory