Infinite loop in Asterisk Open Source - #VU13261
Published: June 12, 2018 / Updated: June 12, 2018
Vulnerability identifier: #VU13261
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-835
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.
The vulnerability exists due to an error when processing malicious input. A remote attacker can send specially crafted data via TCP/TLS or abruptly disconnect to trigger an iostream read error and cause the target service to enter an infinite loop and become unusable.
Affected software
Asterisk Open Source
Remediation
Update to version 15.4.1.
Asterisk Open Source - update to 15.4.1