CVE-2017-9372 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Certified Asterisk

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer5 documents4 sources
Severity
7.5HIGHNVD
EPSS
3.7%
top 12.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Pjsip PjprojectDigium Certified AsteriskDigium Open Source
Timeline
PublishedJun 2
Latest updateMay 17

Description

PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (buffer overflow and application crash) via a SIP packet with a crafted CSeq header in conjunction with a Via header that lacks a branch parameter.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDdigium/open_source26 versions+25
▶Ubuntupjsip/pjproject< 2.1.0.0.ast20130823-1+deb8u1build0.14.04.1+1

🔴Vulnerability Details

2
GHSA
GHSA-f9w9-cxp5-6pq8: PJSIP, as used in Asterisk Open Source 13↗2022-05-17
▶
OSV
CVE-2017-9372: PJSIP, as used in Asterisk Open Source 13↗2017-06-02
▶

💬Community

2
Bugzilla
CVE-2017-12864 opencv: Integer overflow in ReadNumber function in opencv/modules/imgcodecs/src/grfmt_pxm.cpp↗2017-08-21
▶
Bugzilla
CVE-2017-9372 CVE-2017-9358 CVE-2017-9359 asterisk: Multiple security issues↗2017-05-22
▶
CVE-2017-9372 — Digium Certified Asterisk vulnerability | cvebase