CVE-2017-9372

HIGH

Asterisk Open Source 13.x < 13.15.1 and 14.x < 14.4.1 - Denial of Service via Crafted SIP CSeq Header

Title source: llm
STIX 2.1

Description

PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (buffer overflow and application crash) via a SIP packet with a crafted CSeq header in conjunction with a Via header that lacks a branch parameter.

References (5)

Core 5
Core References
Mailing List, Third Party Advisory x_refsource_confirm
https://bugs.debian.org/863901
Third Party Advisory x_refsource_confirm
http://downloads.asterisk.org/pub/security/AST-2017-002.txt
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/98572
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1038529
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2017/dsa-3933

Scores

CVSS v3 7.5
EPSS 0.0399
EPSS Percentile 89.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-119
Status published
Products (27)
digium/certified_asterisk 13.13.0 (10 CPE variants)
digium/open_source 13.0.0
digium/open_source 13.1.0 (3 CPE variants)
digium/open_source 13.2.0 (2 CPE variants)
digium/open_source 13.3.0 rc1
digium/open_source 13.4.0 (2 CPE variants)
digium/open_source 13.5.0 (2 CPE variants)
digium/open_source 13.6.0 rc1
digium/open_source 13.7.0 (2 CPE variants)
digium/open_source 13.8.0 (2 CPE variants)
... and 17 more
Published Jun 02, 2017
Tracked Since Feb 18, 2026