| Vulnerability Name: | CVE-2018-7284 (CCN-139404) | ||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2018-02-21 | ||||||||||||||||||||||||||||||||||||||||
| Published: | 2018-02-21 | ||||||||||||||||||||||||||||||||||||||||
| Updated: | 2019-03-01 | ||||||||||||||||||||||||||||||||||||||||
| Summary: | A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. When processing a SUBSCRIBE request, the res_pjsip_pubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed, despite having a fixed limit of 32. If more than 32 Accept headers were present, the code would write outside of its memory and cause a crash. | ||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) 6.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C)
4.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
| ||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-119 | ||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Denial of Service | ||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2018-7284 Source: CCN Type: Asterisk Project Security Advisory - AST-2018-004 Crash when receiving SUBSCRIBE request Source: CONFIRM Type: Patch, Vendor Advisory http://downloads.asterisk.org/pub/security/AST-2018-004.html Source: BID Type: Third Party Advisory, VDB Entry 103151 Source: CCN Type: BID-103151 Multiple Asterisk Products CVE-2018-7284 Denial of Service Vulnerability Source: SECTRACK Type: Third Party Advisory, VDB Entry 1040416 Source: XF Type: UNKNOWN asterisk-cve20187284-dos(139404) Source: CCN Type: Packet Storm Security [02-26-2018] Asterisk 15.2.0 chan_pjsip SUBSCRIBE Stack Corruption Source: DEBIAN Type: Third Party Advisory DSA-4320 Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [02-27-2018] Source: EXPLOIT-DB Type: Exploit, Third Party Advisory, VDB Entry 44184 Source: CCN Type: WhiteSource Vulnerability Database CVE-2018-7284 | ||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration 3: Configuration 4:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||