CVE-2017-16672 Denial of service in n/a
A memory leak in Asterisk pjsip session handling allows attackers to exhaust memory and crash the service by rejecting calls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-16672?
CVE-2017-16672 is a medium-severity denial of service vulnerability in Digium Asterisk, published on 9 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. A memory leak occurs when an Asterisk pjsip session object is created and that call gets rejected before the session itself is fully established. When this happens the session object never gets destroyed. Eventually Asterisk can run out of memory and crash.
Weakness: CWE-772
Which versions are affected by CVE-2017-16672?
It affects 2 products.
Products include Digium Asterisk, Digium Certified Asterisk.
How do I fix CVE-2017-16672?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-16672 being exploited?
There is no known exploitation of CVE-2017-16672 in the wild and no public exploit code.
Other vulnerabilities in Digium Asterisk
Sources
Also known as DEBIAN-CVE-2017-16672, GHSA-6j42-f94q-5pq7, UBUNTU-CVE-2017-16672.