Bug 1529150 (CVE-2017-17850)

Summary:	CVE-2017-17850 asterisk: Authenticated remote DOS via SIP contact header in PJSIP driver
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bennie.joubert, itamar, jsmith.fedora, rbryant
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	asterisk 13.18.5, asterisk 14.7.5, asterisk 15.1.5	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:34:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1529151, 1529152
Bug Blocks:

Description Pedro Sampaio 2017-12-26 18:51:43 UTC

An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and the PJSIP channel driver was used, Asterisk would crash. The severity of this vulnerability is somewhat mitigated if authentication is enabled. If authentication is enabled, a user would have to first be authorized before reaching the crash point.

Upstream bug:

https://issues.asterisk.org/jira/browse/ASTERISK-27480

References:

https://issues.asterisk.org/jira/secure/attachment/56540/AST-2017-014.pdf

Comment 1 Pedro Sampaio 2017-12-26 18:52:18 UTC

Created asterisk tracking bugs for this issue:

Affects: epel-6 [bug 1529151]
Affects: fedora-all [bug 1529152]

Comment 2 Product Security DevOps Team 2019-06-08 03:34:59 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.