An issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. A memory leak occurs when an Asterisk pjsip session object is created and that call gets rejected before the session itself is fully established. When this happens the session object never gets destroyed. Eventually Asterisk can run out of memory and crash.

The remote host is affected by the vulnerability described in GLSA-201811-11 (Asterisk: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Asterisk. Please review       the referenced CVE identifiers for details.
  Impact :

    A remote attacker could cause a Denial of Service condition or conduct       information gathering.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities have been discovered in Asterisk, an open source PBX and telephony toolkit, which may result in denial of service, information disclosure and potentially the execution of arbitrary code.

According to its SIP banner, the version of Asterisk running on the remote host is 13.x prior to 13.18.1, 14.x prior to 14.7.1, 15.x prior to 15.1.1, or 13.13 prior to 13.13-cert7. It is therefore, affected by multiple vulnerabilities as described in AST-2017-009, AST-2017-010, and AST-2017-011.

Also note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Asterisk project reports :

A memory leak occurs when an Asterisk pjsip session object is created and that call gets rejected before the session itself is fully established. When this happens the session object never gets destroyed. This then leads to file descriptors and RTP ports being leaked as well.

ID	Name	Product	Family	Severity
119131	GLSA-201811-11 : Asterisk: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
105498	Debian DSA-4076-1 : asterisk - security update	Nessus	Debian Local Security Checks	high
104658	Asterisk 13.x < 13.18.1 / 14.x < 14.7.1 / 15.x < 15.1.1 / 13.13 < 13.13-cert7 Multiple Vulnerabilities (AST-2017-009 - AST-2017-011)	Nessus	Misc.	high
104491	FreeBSD : asterisk -- Memory/File Descriptor/RTP leak in pjsip session resource (be261737-c535-11e7-8da5-001999f8d30b)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2017-16672

medium

Tenable Plugins

high

high

high

medium