CVE-2017-14603
HighSummary
In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2, insufficient RTCP packet validation could allow reading stale buffer contents. When combined with the 'nat' and 'symmetric_rtp' options, this could allow redirecting where Asterisk sends the next RTCP report.
Risk Assessment
Organizations may be exposed to data leakage from stale buffers, potentially leading to unauthorized access to information. Additionally, the ability to redirect RTCP reports may affect the integrity of communications.
Recommendation
It is recommended to update Asterisk to the latest version to mitigate this vulnerability. Also, consider reviewing the configuration of 'nat' and 'symmetric_rtp' options.
Other vulnerabilities in Asterisk
See all- CVE-2017-17850High
An issue was discovered in Asterisk versions 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older that causes a crash when processing certain SIP messages without a contact header. This issue occurs only when the PJSIP channel driver is used.
- CVE-2022-37325High
In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src/ooq931.c with a malformed Calling or Called Party IE can cause a crash.
Original NVD description (English source)
In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2 and Certified Asterisk 11.x before 11.6-cert18 and 13.x before 13.13-cert6, insufficient RTCP packet validation could allow reading stale buffer contents and when combined with the "nat" and "symmetric_rtp" options allow redirecting where Asterisk sends the next RTCP report.