CVE-2017-17090

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and older, and Certified Asterisk 13.13-cert7 and older. If the chan_skinny (aka SCCP protocol) channel driver is flooded with certain requests, it can cause the asterisk process to use excessive amounts of virtual memory, eventually causing asterisk to stop processing requests of any kind.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-459

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://downloads.digium.com/pub/security/AST-2017-013.htmlVendor Advisory
http://www.securityfocus.com/bid/102023Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039948
https://issues.asterisk.org/jira/browse/ASTERISK-27452Issue Tracking, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2017/12/msg00028.html
https://www.debian.org/security/2017/dsa-4076
https://www.exploit-db.com/exploits/43992/
http://downloads.digium.com/pub/security/AST-2017-013.htmlVendor Advisory
http://www.securityfocus.com/bid/102023Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039948
https://issues.asterisk.org/jira/browse/ASTERISK-27452Issue Tracking, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2017/12/msg00028.html
https://www.debian.org/security/2017/dsa-4076
https://www.exploit-db.com/exploits/43992/

Timeline

Published: Dec 2, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-170918.8wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which al CVE-2017-170925.4wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might all CVE-2017-170935.4wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might all CVE-2017-170945.4wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to CVE-2017-170958.8tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (TIFFSetupStrips heap-based buffer overflow CVE-2017-170966.1Cross-site scripting (XSS) vulnerability in the Content Cards plugin before 0.9.7 for WordPress allows remote attackers to inject arbitrary CVE-2017-170979.8gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthentica CVE-2017-170989.8The writeLog function in fn_common.php in gps-server.net GPS Tracking Software (self hosted) through 3.0 allows remote attackers to inject a CVE-2017-170997.8There exists an unauthenticated SEH based Buffer Overflow vulnerability in the HTTP server of Flexense SyncBreeze Enterprise v10.1.16. When CVE-2017-17109.8A vulnerability in the Service Assistant GUI in IBM Storwize V7000 (2076) 8.1 could allow a remote attacker to perform a privilege escalatio CVE-2017-171019.8An issue was discovered in Apexis APM-H803-MPC software, as used with many different models of IP Camera. An unprotected CGI method inside t CVE-2017-171027.5Fiyo CMS 2.0.7 has SQL injection in /system/site.php via $_REQUEST['link'].