NetSight
IP …
high7.5

CVE-2017-14603

In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2 and Certified Asterisk 11.x before 11.6-cert18 and 13.x before 13.13-cert6, insuff…

Impact

In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2 and Certified Asterisk 11.x before 11.6-cert18 and 13.x before 13.13-cert6, insufficient RTCP packet validation could allow reading stale buffer contents and when combined with the "nat" and "symmetric_rtp" options allow redirecting where Asterisk sends the next RTCP report.

Affected products

VendorProductAffected versions
DigiumAsterisk
Versions 13.0.0, 13.0.1, 13.0.2, 13.1.0, 13.1.1, 13.2.0
DigiumCertified Asterisk
Versions 11.6, 13.13

Weakness classification

CWE-200

References