#VU16064 Buffer overflow in Certified Asterisk and Asterisk Open Source - CVE-2017-16671
Published: November 24, 2018 / Updated: November 26, 2018
Vulnerability identifier: #VU16064
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2017-16671
CWE-ID: CWE-120
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Certified Asterisk
Asterisk Open Source
Certified Asterisk
Asterisk Open Source
Software vendor:
Digium (Linux Support Services)
Digium (Linux Support Services)
Description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error when setting the user field for Party B on a CDR. A remote unauthenticated attacker can send a specially-crafted request, trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Update Asterisk Open Source to version 13.18.1, 14.7.1,15.1.1.
Update Certified Asterisk to version 13.13-cert7.
Update Certified Asterisk to version 13.13-cert7.