vulnwire
7.5high

CVE-2017-17090in critical feed1 exploit

An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and older, and Certified A…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
82.2%
percentile 100%
Public exploits
1
Exploit-DB

An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and older, and Certified Asterisk 13.13-cert7 and older. If the chan_skinny (aka SCCP protocol) channel driver is flooded with certain requests, it can cause the asterisk process to use excessive amounts of virtual memory, eventually causing asterisk to stop processing requests of any kind.

Exploit prediction (EPSS)

82.20% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • EDB-43992 Asterisk 13.17.2 - 'chan_skinny' Remote Memory Corruption · dos · 2018-02-07

CVSS scores

Assigned byVersionScoreVector
NVD3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:N/A:P

Classification

Weakness

References

  • securitytracker.com /id/1039948 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • exploit-db.com /exploits/43992/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • securityfocus.com /bid/102023 · vdb-entry, x_refsource_BID, x_transferred
  • issues.asterisk.org /jira/browse/ASTERISK-27452 · x_refsource_CONFIRM, x_transferred
  • lists.debian.org /debian-lts-announce/2017/12/msg00028.html · mailing-list, x_refsource_MLIST, x_transferred
  • debian.org /security/2017/dsa-4076 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • downloads.digium.com /pub/security/AST-2017-013.html · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.