CVSS: 7.5EPSS: 0%CPEs: 189EXPL: 0CVE-2017-14603
https://notcve.org/view.php?id=CVE-2017-14603
In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2 and Certified Asterisk 11.x before 11.6-cert18 and 13.x before 13.13-cert6, insufficient RTCP packet validation could allow reading stale buffer contents and when combined with the "nat" and "symmetric_rtp" options allow redirecting where Asterisk sends the next RTCP report. En Asterisk enversiones 11.x anteriores a la 11.25.3, versiones 13.x anteriores a la 13.17.2 y versiones 14.x anteriores a la 14.6.2; y en Certified Asterisk en versiones 11.x anteriores a la 11.6-cert18 y versiones 13.x anteriores a la 13.13-cert6, una validación insuficiente de paquetes RTCP podría permitir la lectura de contenidos obsoletos del búfer y, cuando se combina con las opciones "nat" y "symmetric_rtp", permite las redirecciones en las que Asterisk envía el siguiente informe RTCP. • http://downloads.asterisk.org/pub/security/AST-2017-008.html http://www.debian.org/security/2017/dsa-3990 https://issues.asterisk.org/jira/browse/ASTERISK-27274 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 2%CPEs: 189EXPL: 0CVE-2017-14099
https://notcve.org/view.php?id=CVE-2017-14099
In res/res_rtp_asterisk.c in Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized data disclosure (media takeover in the RTP stack) is possible with careful timing by an attacker. The "strictrtp" option in rtp.conf enables a feature of the RTP stack that learns the source address of media for a session and drops any packets that do not originate from the expected address. This option is enabled by default in Asterisk 11 and above. The "nat" and "rtp_symmetric" options (for chan_sip and chan_pjsip, respectively) enable symmetric RTP support in the RTP stack. This uses the source address of incoming media as the target address of any sent media. • http://downloads.asterisk.org/pub/security/AST-2017-005.html http://www.debian.org/security/2017/dsa-3964 http://www.securitytracker.com/id/1039251 https://bugs.debian.org/873907 https://issues.asterisk.org/jira/browse/ASTERISK-27013 https://rtpbleed.com https://security.gentoo.org/glsa/201710-29 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 96%CPEs: 189EXPL: 0CVE-2017-14100
https://notcve.org/view.php?id=CVE-2017-14100
In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized command execution is possible. The app_minivm module has an "externnotify" program configuration option that is executed by the MinivmNotify dialplan application. The application uses the caller-id name and number as part of a built string passed to the OS shell for interpretation and execution. Since the caller-id name and number can come from an untrusted source, a crafted caller-id name or number allows an arbitrary shell command injection. En Asterisk 11.x en versiones anteriores a la 11.25.2, 13.x en versiones anteriores a la 13.17.1, y 14.x en versiones anteriores a la 14.6.1 y Certified Asterisk 11.x en versiones anteriores a la 11.6-cert17 y 13.x en versiones anteriores a la 13.13-cert5, es ejecutar comandos sin autorización. • http://downloads.asterisk.org/pub/security/AST-2017-006.html http://www.debian.org/security/2017/dsa-3964 http://www.securitytracker.com/id/1039252 https://bugs.debian.org/873908 https://issues.asterisk.org/jira/browse/ASTERISK-27103 https://security.gentoo.org/glsa/201710-29 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 1%CPEs: 50EXPL: 0CVE-2017-9372
https://notcve.org/view.php?id=CVE-2017-9372
PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (buffer overflow and application crash) via a SIP packet with a crafted CSeq header in conjunction with a Via header that lacks a branch parameter. PJSIP, tal como es usado en Asterisk Open Source versiones 13.x y anteriores a 13.15.1 y versiones 14.x y anteriores a 14.4.1, Certified Asterisk versión 13.13 y anteriores a 13.13-cert4, y otros productos, permite a los atacantes remotos causar una denegación de servicio (desbordamiento de búfer y bloqueo de aplicación) por medio de un paquete SIP con un encabezado CSeq especialmente diseñado junto con un encabezado Via que carece de un parámetro branch. • http://downloads.asterisk.org/pub/security/AST-2017-002.txt http://www.debian.org/security/2017/dsa-3933 http://www.securityfocus.com/bid/98572 http://www.securitytracker.com/id/1038529 https://bugs.debian.org/863901 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 42EXPL: 0CVE-2017-9359
https://notcve.org/view.php?id=CVE-2017-9359
The multi-part body parser in PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. El analizador multi-part body en PJSIP, tal como es usado en Asterisk Open Source versiones 13.x y anteriores a 13.15.1 y versiones 14.x y anteriores a 14.4.1, Certified Asterisk versión 13.13 y anteriores a 13.13-cert4, y otros productos, permite a los atacantes remotos causar una denegación de servicio (lectura fuera de límites y bloqueo de aplicación) por medio de un paquete especialmente diseñado. • http://downloads.asterisk.org/pub/security/AST-2017-003.txt http://www.debian.org/security/2017/dsa-3933 http://www.securityfocus.com/bid/98578 https://bugs.debian.org/863902 https://issues.asterisk.org/jira/browse/ASTERISK-26939 • CWE-125: Out-of-bounds Read •