CVE-2017-14098 Denial of service in n/a

High 7.5 Published 2 Sep 2017 Updated 5 Aug 2024

A crafted tel URI in SIP headers can crash the Asterisk PBX, causing a denial of service for administrators and users.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2017-14098?

CVE-2017-14098 is a high-severity denial of service vulnerability in Digium Asterisk, published on 2 Sep 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel URI in a From, To, or Contact header could cause Asterisk to crash.

Weakness: CWE-20

Which versions are affected by CVE-2017-14098?

It affects 1 product.

Products include Digium Asterisk.

How do I fix CVE-2017-14098?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2017-14098 being exploited?

There is no known exploitation of CVE-2017-14098 in the wild and no public exploit code.

All Digium Asterisk vulnerabilities

Sources

Also known as DEBIAN-CVE-2017-14098, GHSA-cfqc-p9r2-849r, UBUNTU-CVE-2017-14098.