CVE-2017-16671

Published: Nov 09, 2017 Last Modified: Apr 20, 2025 EU-VD ID: EUVD-2017-7855 Aliases: GSD-2017-16671
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
MEDIUM 6,5
Source: [email protected]
Access Vector: network
Access Complexity: low
Authentication: single
Confidentiality: partial
Integrity: partial
Availability: partial

Description

AI Translation Available

A Buffer Overflow issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. No size checking is done when setting the user field for Party B on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. NOTE: this is different from CVE-2017-7617, which was only about the Party A buffer.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0364
Percentile
0,9th
Updated

EPSS Score Trend (Last 90 Days)

119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Stable
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability
Potential Impacts:
Execute Unauthorized Code Or Commands Modify Memory Read Memory Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory)
Applicable Platforms
Languages: Assembly, C, C++, Memory-Unsafe
Likelihood of Exploit: High
View CWE Details
Application

Certified Asterisk by Digium

Product Information
Vendor Digium
Product Certified Asterisk
Version 13.13.0
cpe:2.3:a:digium:certified_asterisk:13.13.0:cert1_rc4:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Certified Asterisk by Digium

Product Information
Vendor Digium
Product Certified Asterisk
Version 13.13.0
cpe:2.3:a:digium:certified_asterisk:13.13.0:cert4:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Certified Asterisk by Digium

Product Information
Vendor Digium
Product Certified Asterisk
Version 13.13.0
cpe:2.3:a:digium:certified_asterisk:13.13.0:cert1_rc1:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Certified Asterisk by Digium

Product Information
Vendor Digium
Product Certified Asterisk
Version 13.13.0
cpe:2.3:a:digium:certified_asterisk:13.13.0:cert3:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Asterisk by Digium

Product Information
Vendor Digium
Product Asterisk
Version Range Affected
From 14.0.0 (inclusive)
To 14.7.1 (exclusive)
cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Certified Asterisk by Digium

Product Information
Vendor Digium
Product Certified Asterisk
Version 13.13.0
cpe:2.3:a:digium:certified_asterisk:13.13.0:cert5:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Asterisk by Digium

Product Information
Vendor Digium
Product Asterisk
Version Range Affected
From 15.0.0 (inclusive)
To 15.1.1 (exclusive)
cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Certified Asterisk by Digium

Product Information
Vendor Digium
Product Certified Asterisk
Version 13.13.0
cpe:2.3:a:digium:certified_asterisk:13.13.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Asterisk by Digium

Product Information
Vendor Digium
Product Asterisk
Version Range Affected
From 13.0.0 (inclusive)
To 13.18.1 (exclusive)
cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Certified Asterisk by Digium

Product Information
Vendor Digium
Product Certified Asterisk
Version 13.13.0
cpe:2.3:a:digium:certified_asterisk:13.13.0:cert1_rc3:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Certified Asterisk by Digium

Product Information
Vendor Digium
Product Certified Asterisk
Version 13.13.0
cpe:2.3:a:digium:certified_asterisk:13.13.0:cert2:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Certified Asterisk by Digium

Product Information
Vendor Digium
Product Certified Asterisk
Version 13.13.0
cpe:2.3:a:digium:certified_asterisk:13.13.0:cert6:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Certified Asterisk by Digium

Product Information
Vendor Digium
Product Certified Asterisk
Version 13.13.0
cpe:2.3:a:digium:certified_asterisk:13.13.0:cert1_rc2:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Certified Asterisk by Digium

Product Information
Vendor Digium
Product Certified Asterisk
Version 13.13.0
cpe:2.3:a:digium:certified_asterisk:13.13.0:cert1:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
http://downloads.digium.com/pub/security/AST-2017-010.html
Vendor Advisory
http://downloads.digium.com/pub/security/AST-2017-010.html
https://issues.asterisk.org/jira/browse/ASTERISK-27337
Issue Tracking Vendor Advisory
https://issues.asterisk.org/jira/browse/ASTERISK-27337
https://security.gentoo.org/glsa/201811-11
https://security.gentoo.org/glsa/201811-11
https://www.debian.org/security/2017/dsa-4076
https://www.debian.org/security/2017/dsa-4076
http://www.securityfocus.com/bid/101760
Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/101760
http://downloads.digium.com/pub/security/AST-2017-010.html
Vendor Advisory
http://downloads.digium.com/pub/security/AST-2017-010.html
https://issues.asterisk.org/jira/browse/ASTERISK-27337
Issue Tracking Vendor Advisory
https://issues.asterisk.org/jira/browse/ASTERISK-27337
https://security.gentoo.org/glsa/201811-11
https://security.gentoo.org/glsa/201811-11
https://www.debian.org/security/2017/dsa-4076
https://www.debian.org/security/2017/dsa-4076
http://www.securityfocus.com/bid/101760
Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/101760