Login Request a demo
Medium severity · published Nov 9, 2017
CVE-2017-16672
An issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7
5.9
CVSS
4.7%
EPSS
No
On KEV
Description
An issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. A memory leak occurs when an Asterisk pjsip session object is created and that call gets rejected before the session itself is fully established. When this happens the session object never gets destroyed. Eventually Asterisk can run out of memory and crash.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.7% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Asterisk · Digium
13.0.0 before 13.18.1; 14.0.0 before 14.7.1; 15.0.0 before 15.1.1 · source: NVD
CA
Certified Asterisk · Digium
13.13.0; 13.13.0; 13.13.0; 13.13.0; 13.13.0; 13.13.0; +5 more · source: NVD
Affected product
AS
Asterisk
Digium
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-16672
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-16672
Vendor Advisory
http://downloads.digium.com/pub/security/AST-2017-011.html
Third Party Advisory
http://www.securityfocus.com/bid/101765
Vendor Advisory
https://issues.asterisk.org/jira/browse/ASTERISK-27345
security.gentoo.org
https://security.gentoo.org/glsa/201811-11
www.debian.org
https://www.debian.org/security/2017/dsa-4076
More from Asterisk
9.8
CVE-2022-26651
An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13
9.8
CVE-2017-14100
In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized command…
9.1
CVE-2022-26499
An SSRF issue was discovered in Asterisk through 19.x
8.8
CVE-2019-18610
An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4
8.8
CVE-2017-16671
A Buffer Overflow issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7