CVE-2017-9372

PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified...

7.5 HighFix available

CVE-2017-9372 is a high vulnerability (CVSS 7.5) in Digium Certified Asterisk, published June 2, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.99%, the 90th percentile. Fixed in pjproject 2.1.0.0.ast20130823-1+deb8u1build0.14.04.1.

What does this mean?

Severity: 7.5 HighCVSS 3.0, NVD
Exploit chance: 3.99%EPSS, 90th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 2.1.0.0.ast20130823-1+deb8u1build0.14.04.1pjproject +4 more

Description

PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (buffer overflow and application crash) via a SIP packet with a crafted CSeq header in conjunction with a Via header that lacks a branch parameter.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

3.99%Up 2.0 points since Apr 14, 2021

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`pjproject` Debian:8 From an advisory covering 2 CVEs	before 2.1.0.0.ast20130823-1+deb8u1, plus listed versions 2.1.0.0.ast20130823-1	2.1.0.0.ast20130823-1+deb8u1
`pjproject` Mageia:5 From an advisory covering 2 CVEs	before 2.3-1.1.mga5	2.3-1.1.mga5
`pjproject` Mageia:6 From an advisory covering 2 CVEs	before 2.5.5-4.1.mga6	2.5.5-4.1.mga6
`pjproject` Ubuntu:14.04:LTS	before 2.1.0.0.ast20130823-1+deb8u1build0.14.04.1, plus listed versions 2.1.0.0.ast20130823-1	2.1.0.0.ast20130823-1+deb8u1build0.14.04.1
`pjproject` Ubuntu:16.04:LTS	before 2.1.0.0.ast20130823-1+deb8u1build0.16.04.1, plus listed versions 2.1.0.0.ast20130823-1	2.1.0.0.ast20130823-1+deb8u1build0.16.04.1