Bug 645710 (CVE-2017-17850)

Summary:	<net-misc/asterisk-13.18.4: Authenticated remote DOS via SIP contact header in PJSIP driver (CVE-2017-17850)
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	arthur, chainsaw
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B3 [glsa+ cve]
Package list:		Runtime testing required:	---

Description GLSAMaker/CVETool Bot gentoo-dev

2018-01-25 15:55:34 UTC

CVE-2017-17850 (https://nvd.nist.gov/vuln/detail/CVE-2017-17850):
  An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older,
  15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages
  create a dialog in Asterisk. Those SIP messages must contain a contact
  header. For those messages, if the header was not present and the PJSIP
  channel driver was used, Asterisk would crash. The severity of this
  vulnerability is somewhat mitigated if authentication is enabled. If
  authentication is enabled, a user would have to first be authorized before
  reaching the crash point.

Comment 1 Yury German Gentoo Infrastructure

2018-11-13 01:02:52 UTC

GLSA Vote: Yes

Added to an existing GLSA Request.

Comment 2 GLSAMaker/CVETool Bot gentoo-dev

2018-11-24 19:46:15 UTC

This issue was resolved and addressed in
 GLSA 201811-11 at https://security.gentoo.org/glsa/201811-11
by GLSA coordinator Aaron Bauman (b-man).