Buffer overflow in Asterisk Open Source and Certified Asterisk - CVE-2017-16671
Published: November 24, 2018 / Updated: November 26, 2018
Vulnerability identifier: #VU16064
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-16671
CWE-ID: CWE-120
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error when setting the user field for Party B on a CDR. A remote unauthenticated attacker can send a specially-crafted request, trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Asterisk Open Source
Certified Asterisk
Gentoo Linux
Fedora
asterisk
Certified Asterisk
Gentoo Linux
Fedora
asterisk
How to mitigate CVE-2017-16671
Update Asterisk Open Source to version 13.18.1, 14.7.1,15.1.1.
Update Certified Asterisk to version 13.13-cert7.
Update Certified Asterisk to version 13.13-cert7.
Asterisk Open Source - addressed in versions 13.18.1, 14.7.1, 15.1.1
Certified Asterisk - update to 13.13-cert7
asterisk - update to 14.7.6-2.fc27
Certified Asterisk - update to 13.13-cert7
asterisk - update to 14.7.6-2.fc27