CVE-2017-17090 : What You Need to Know
Discover the impact of CVE-2017-17090 found in Asterisk Open Source and Certified Asterisk versions, leading to memory exhaustion and denial of service. Learn mitigation steps and long-term security practices.
A vulnerability was found in chan_skinny.c in versions 13.18.2 and older, 14.7.2 and older, and 15.1.2 and older of Asterisk Open Source, as well as in versions 13.13-cert7 and older of Certified Asterisk. This vulnerability can lead to excessive virtual memory consumption and a complete halt in processing requests.
Understanding CVE-2017-17090
This CVE identifies a vulnerability in the Asterisk Open Source and Certified Asterisk versions, potentially causing a denial of service due to memory exhaustion.
What is CVE-2017-17090?
The vulnerability in chan_skinny.c can result in the Asterisk process consuming excessive virtual memory when flooded with specific requests, leading to a system-wide processing halt.
The Impact of CVE-2017-17090
The vulnerability can be exploited to cause a denial of service by exhausting virtual memory, rendering the Asterisk system unresponsive to any requests.
Technical Details of CVE-2017-17090
This section provides detailed technical information about the vulnerability.
Vulnerability Description
The issue in chan_skinny.c affects specific versions of Asterisk Open Source and Certified Asterisk, causing the system to consume excessive virtual memory under certain conditions.
Affected Systems and Versions
- Asterisk Open Source versions 13.18.2 and older, 14.7.2 and older, 15.1.2 and older
- Certified Asterisk versions 13.13-cert7 and older
Exploitation Mechanism
When the chan_skinny channel driver receives an overwhelming number of specific requests, it triggers the excessive consumption of virtual memory, potentially leading to a system-wide processing halt.
Mitigation and Prevention
Protecting systems from CVE-2017-17090 requires immediate actions and long-term security practices.
Immediate Steps to Take
- Apply patches provided by the vendor to mitigate the vulnerability
- Monitor system resources for any unusual memory consumption patterns
Long-Term Security Practices
- Regularly update and patch Asterisk installations to prevent known vulnerabilities
- Implement network-level protections to mitigate denial-of-service attacks
Patching and Updates
- Stay informed about security advisories and updates from Asterisk
- Apply security patches promptly to address known vulnerabilities