Stack-based buffer overflow in Asterisk Open Source and Certified Asterisk - CVE-2018-17281
Published: September 24, 2018
Vulnerability identifier: #VU14912
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-17281
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when processing HTTP requests within "res_http_websocket.so" module. A remote unauthenticated attacker can send a specially crafted HTTP request that triggers an HTTP websocket upgrade, causes stack overflow and consumes all available stack memory on the system.
Successful exploitation of this vulnerability may result in denial of service attack.
Affected software
Asterisk Open Source
Certified Asterisk
Gentoo Linux
asterisk (Debian package)
Certified Asterisk
Gentoo Linux
asterisk (Debian package)
How to mitigate CVE-2018-17281
Install updates from vendor's website.
Asterisk Open Source - addressed in versions 13.23.1, 14.7.8, 15.6.1
Certified Asterisk - update to 13.21-cert3
asterisk (Debian package) - update to 1:13.14.1~dfsg-2+deb9u4
Certified Asterisk - update to 13.21-cert3
asterisk (Debian package) - update to 1:13.14.1~dfsg-2+deb9u4