7.5
CVSSv3

CVE-2017-14603

Published: 10/10/2017 Updated: 05/11/2017
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Summary

In Asterisk 11.x prior to 11.25.3, 13.x prior to 13.17.2, and 14.x prior to 14.6.2 and Certified Asterisk 11.x prior to 11.6-cert18 and 13.x prior to 13.13-cert6, insufficient RTCP packet validation could allow reading stale buffer contents and when combined with the "nat" and "symmetric_rtp" options allow redirecting where Asterisk sends the next RTCP report.

Vulnerable Product Search on Vulmon Subscribe to Product

digium asterisk 13.0.2

digium asterisk 13.1.0

digium asterisk 13.1.1

digium asterisk 13.7.1

digium asterisk 13.7.2

digium asterisk 13.8.0

digium asterisk 13.13

digium asterisk 13.13.0

digium asterisk 13.13.1

digium asterisk 13.14.0

digium asterisk 13.0.0

digium asterisk 13.3.2

digium asterisk 13.4.0

digium asterisk 13.5.0

digium asterisk 13.10.0

digium asterisk 13.11.0

digium asterisk 13.11.1

digium asterisk 13.11.2

digium asterisk 13.15.0

digium asterisk 13.0.1

digium asterisk 13.2.0

digium asterisk 13.3.0

digium asterisk 13.7.0

digium asterisk 13.8.2

digium asterisk 13.9.1

digium asterisk 13.12.0

digium asterisk 13.12.2

digium asterisk 13.14.1

digium asterisk 13.16.0

digium asterisk 13.17.0

digium asterisk 13.15.1

digium asterisk 13.2.1

digium asterisk 13.6.0

digium asterisk 13.8.1

digium asterisk 13.9.0

digium asterisk 13.12

digium asterisk 13.12.1

digium asterisk 14.0

digium asterisk 14.0.0

digium asterisk 14.2.0

digium asterisk 14.2.1

digium asterisk 14.3.0

digium asterisk 14.0.1

digium asterisk 14.1.1

digium asterisk 14.2

digium asterisk 14.3.1

digium asterisk 14.4.0

digium asterisk 14.6.0

digium asterisk 14.0.2

digium asterisk 14.01

digium asterisk 14.1

digium asterisk 14.1.0

digium asterisk 14.4.1

digium asterisk 14.5.0

digium asterisk 14.1.2

digium asterisk 14.02

digium asterisk 11.0.0

digium asterisk 11.6.0

digium asterisk 11.6.1

digium asterisk 11.10.0

digium asterisk 11.10.1

digium asterisk 11.10.2

digium asterisk 11.14.2

digium asterisk 11.15.0

digium asterisk 11.0.2

digium asterisk 11.2.0

digium asterisk 11.2.2

digium asterisk 11.7.0

digium asterisk 11.8.0

digium asterisk 11.9.0

digium asterisk 11.11.0

digium asterisk 11.12.0

digium asterisk 11.14.0

digium asterisk 11.14.1

digium asterisk 11.16.0

digium asterisk 11.17.1

digium asterisk 11.21.1

digium asterisk 11.22.0

digium asterisk 11.25.0

digium asterisk 11.1.0

digium asterisk 11.1.1

digium asterisk 11.8.1

digium asterisk 11.12.1

digium asterisk 11.13.0

digium asterisk 11.13.1

digium asterisk 11.18.0

digium asterisk 11.19.0

digium asterisk 11.20.0

digium asterisk 11.21.0

digium asterisk 11.15.1

digium asterisk 11.23.0

digium asterisk 11.23.1

digium asterisk 11.24.0

digium asterisk 11.0.1

digium asterisk 11.1.2

digium asterisk 11.2.1

digium asterisk 11.4.0

digium asterisk 11.17.0

digium asterisk 11.21.2

digium asterisk 11.24.1

digium asterisk 11.25.1

digium certified asterisk 11.6

digium certified asterisk 13.13

Vendor Advisories

Debian Bug report logs - #876328 asterisk: CVE-2017-14603: RTP/RTCP information leak (AST-2017-008) Package: src:asterisk; Maintainer for src:asterisk is Debian VoIP Team <pkg-voip-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 21 Sep 2017 05:45:01 UTC Severity: ...
Klaus-Peter Junghann discovered that insufficient validation of RTCP packets in Asterisk may result in an information leak Please see the upstream advisory at downloadsasteriskorg/pub/security/AST-2017-008html for additional details For the oldstable distribution (jessie), this problem has been fixed in version 1:11131~dfsg-2+deb8u4 ...