CVE-2016-7551

High

Published: 17/04/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In Asterisk Open Source versions 11.x before 11.23.1 and 13.x before 13.11.1, as well as Certified Asterisk 11.6 before 11.6-cert15 and 13.8 before 13.8-cert3, there is a vulnerability in the chain_sip module that allows remote attackers to cause a denial of service (port exhaustion).

Risk Assessment

Attackers can exploit this vulnerability to exhaust available ports, leading to service unavailability for users. This may impact the organization's operational continuity and reputation.

Recommendation

It is recommended to update Asterisk to the latest version to mitigate this vulnerability. Additionally, monitor network traffic for potential attack attempts.

Other vulnerabilities in Asterisk Open Source, Certified Asterisk

CVE-2014-2286High
In Asterisk Open Source versions 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, as well as Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, there is a vulnerability that allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers.

Original NVD description (English source)

chain_sip in Asterisk Open Source 11.x before 11.23.1 and 13.x 13.11.1 and Certified Asterisk 11.6 before 11.6-cert15 and 13.8 before 13.8-cert3 allows remote attackers to cause a denial of service (port exhaustion).