A Buffer Overflow issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. No size checking is done when setting the user field for Party B on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. NOTE: this is different from CVE-2017-7617, which was only about the Party A buffer.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4814-1 advisory.

    Richard Mudgett discovered that Asterisk did not properly check the length of input string when setting     the user field for PartyB on a CDR. A remote attacker could use this vulnerability to cause a denial of     service (crash) or potentially execute arbitrary code. (CVE-2017-16671)

    Alex Villacis Lasso discovered that Asterisk did not properly check the length of input string when     setting the user field for PartyA on a CDR. A remote attacker could use this vulnerability to cause a     denial of service (crash) or potentially execute arbitrary code. (CVE-2017-7617)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201811-11 (Asterisk: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Asterisk. Please review       the referenced CVE identifiers for details.
  Impact :

    A remote attacker could cause a Denial of Service condition or conduct       information gathering.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities have been discovered in Asterisk, an open source PBX and telephony toolkit, which may result in denial of service, information disclosure and potentially the execution of arbitrary code.

According to its SIP banner, the version of Asterisk running on the remote host is 13.x prior to 13.18.1, 14.x prior to 14.7.1, 15.x prior to 15.1.1, or 13.13 prior to 13.13-cert7. It is therefore, affected by multiple vulnerabilities as described in AST-2017-009, AST-2017-010, and AST-2017-011.

Also note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Asterisk project reports :

No size checking is done when setting the user field for Party B on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. The earlier AST-2017-001 advisory for the CDR user field overflow was for the Party A buffer.

ID	Name	Product	Family	Severity
183588	Ubuntu 16.04 ESM : Asterisk vulnerabilities (USN-4814-1)	Nessus	Ubuntu Local Security Checks	high
119131	GLSA-201811-11 : Asterisk: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
105498	Debian DSA-4076-1 : asterisk - security update	Nessus	Debian Local Security Checks	high
104658	Asterisk 13.x < 13.18.1 / 14.x < 14.7.1 / 15.x < 15.1.1 / 13.13 < 13.13-cert7 Multiple Vulnerabilities (AST-2017-009 - AST-2017-011)	Nessus	Misc.	high
104490	FreeBSD : asterisk -- Buffer overflow in CDR's set user (ab04cb0b-c533-11e7-8da5-001999f8d30b)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-16671

high

Tenable Plugins

high

high

high

high

high