CVE-2017-17090

CVE-2017-17090

Published · Updated

45Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 82%
from disclosure to weapon67 days
Published on NVDDec 2
1st PoC+67d
exploitation probability
82%top 1% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
red_hat_products
An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and older, and Certified Asterisk 13.13-cert7 and older. If the chan_skinny (aka SCCP protocol) channel driver is flooded with certain requests, it can cause the asterisk process to use excessive amounts of virtual memory, eventually causing asterisk to stop processing requests of any kind.
Affected products
n/a · n/a
public PoCs found — 2✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/43992cve_referencewww.exploit-db.com/exploits/43992/unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://downloads.digium.com/pub/security/AST-2017-013.htmlhttps://issues.asterisk.org/jira/browse/ASTERISK-27452https://lists.debian.org/debian-lts-announce/2017/12/msg00028.htmlhttps://www.debian.org/security/2017/dsa-4076https://www.exploit-db.com/exploits/43992/http://www.securityfocus.com/bid/102023http://www.securitytracker.com/id/1039948