Cloudanix VulnDB

CVE-2017-16671

High · 8.8

CVSS

8.8

EPSS

4.2%

Published

Nov 9, 2017

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the phone system software can let someone send specially crafted data that crashes the server or potentially takes it over.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Remote Code Execution
Component
Application
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing bounds check when populating the user field for Party B in a CDR record allows an attacker-supplied string of arbitrary length to overwrite adjacent stack or heap memory, resulting in memory corruption that can lead to denial of service or arbitrary code execution.

Why it matters to the business

Successful exploitation can crash or take control of a telephony server, interrupting voice services, enabling eavesdropping or fraud, and requiring emergency incident response.

How an attack unfolds

An attacker with the ability to initiate or influence a call leg supplies an excessively long value that Asterisk stores into the Party B user field of a CDR without length validation; the overflow corrupts adjacent memory structures and can be leveraged to redirect execution flow or trigger a crash.

How to fix it

Upgrade Asterisk Open Source to 13.18.1 or newer, 14.7.1 or newer, or 15.1.1 or newer; for Certified Asterisk 13.13 move to 13.13-cert7 or newer. The GIT fix is present in commit b7607c41e4825490ffea9d09c0b3b8f9d65f87c0. Apply the update and restart the service.

How to confirm the fix worked

Confirm the running version is at or above the fixed releases listed above; perform a functional test that exercises CDR generation with long user-field values and verify no crash or memory error occurs.

Typical attack path

  1. Locate an externally reachable Asterisk instance running an unpatched 13.x, 14.x or 15.x release
  2. Initiate a call or send a signaling message that populates the CDR Party B user field
  3. Supply a payload larger than the allocated buffer to trigger the overflow
  4. Use the resulting memory corruption to achieve code execution or service denial

How to detect it

Review Asterisk logs for unusually long CDR user-field entries, segmentation faults, or abrupt process restarts around the time of call setup; correlate with SIP or other signaling traffic containing oversized fields.

What your security team should do

  • Patch all Asterisk instances to the fixed versions immediately
  • Restrict unauthenticated call initiation from untrusted networks until patches are applied
  • Monitor for unexpected Asterisk process restarts or CDR anomalies

The record

A Buffer Overflow issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. No size checking is done when setting the user field for Party B on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. NOTE: this is different from CVE-2017-7617, which was only about the Party A buffer.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 asterisk 0 1:13.18.1~dfsg-1
Ubuntu:18.04:LTS asterisk 0 1:13.18.3~dfsg-1ubuntu4
Ubuntu:Pro:16.04:LTS asterisk 0 1:13.1.0~dfsg-1.1ubuntu4.1+esm1

Related vulnerabilities