CVE-2017-14099

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2017-14099

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14099.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2017-14099

Related

Published

2017-09-02T16:29:00Z

Modified

2025-01-14T07:33:15.374475Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

In res/resrtpasterisk.c in Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized data disclosure (media takeover in the RTP stack) is possible with careful timing by an attacker. The "strictrtp" option in rtp.conf enables a feature of the RTP stack that learns the source address of media for a session and drops any packets that do not originate from the expected address. This option is enabled by default in Asterisk 11 and above. The "nat" and "rtpsymmetric" options (for chansip and chan_pjsip, respectively) enable symmetric RTP support in the RTP stack. This uses the source address of incoming media as the target address of any sent media. This option is not enabled by default, but is commonly enabled to handle devices behind NAT. A change was made to the strict RTP support in the RTP stack to better tolerate late media when a reinvite occurs. When combined with the symmetric RTP support, this introduced an avenue where media could be hijacked. Instead of only learning a new address when expected, the new code allowed a new source address to be learned at all times. If a flood of RTP traffic was received, the strict RTP support would allow the new address to provide media, and (with symmetric RTP enabled) outgoing traffic would be sent to this new address, allowing the media to be hijacked. Provided the attacker continued to send traffic, they would continue to receive traffic as well.

References

Affected packages

Debian:11 / asterisk

Package

Name: asterisk
Purl: pkg:deb/debian/asterisk?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:13.17.1~dfsg-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/asterisk/asterisk

Affected ranges

Type: GIT
Repo: https://github.com/asterisk/asterisk
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

0356032772b3b5074a85676f4b616bbbdd68ed50

Last affected

06f5ace1fa80ce0799c6d25954de2236a1f842c8

Last affected

0800ab33b5502d3a28409f813a698e298c55a2a7

Last affected

0a1b924030d38524f9d645457fbbb82cb05b00bb

Last affected

0ae8d2ed7cdf3e6439f8dc98a1082da1f38e0459

Last affected

0c00ee754b436ca926b92b469ce259e8fdc8732e

Last affected

0ef6b6960d1c46b62df9974294392192c1398adf

Last affected

0f8d2744dce295cd0629e26b07cd51ad4bf5da9a

Last affected

106c33d20fe0709159a6c57c970cc95a98bfba9f

Last affected

11b0fb111b11aeaf3aaeed62601c42ca5a5b68bc

Last affected

155bff138212257ca6ed34a824a5dfe3ed830830

Last affected

1639644ba71c01a03ceec06da8899b9dad62818c

Last affected

19533f3faeb345568d2aea9bbc7fd841f962e815

Last affected

19e035d2e83cb68a25fe319c9e06dcb3f3b2da87

Last affected

19fb526344f10be789d52b2c444d13a2a0ba0a8b

Last affected

1a9331e814407d43a2e46e24825a6eedc7f2805f

Last affected

208bd3475012cf6491ef93a515e80860b7b976ba

Last affected

20d6fa772155d115c7ab2cedd51f84a45549420d

Last affected

211d2836de28a51a91c1cb27f1ab16eba05c9b51

Last affected

2157c83db3604fdab1892f330146d935ead75c97

Last affected

226a7e36c538de73cee76de4183b1569bd5501e5

Last affected

22f1f880c43a69190db29b73fede7073580bbc09

Last affected

249bb3e7296bbef2daaf889f74807ef6cac407d6

Last affected

24e12d30603cf14aabe87376a18abdb01d3c1999

Last affected

27a592b8e77ed5735c586d7230125dbe3d52e595

Last affected

294da68ab62b662940fb623affa6ea3b03be338e

Last affected

2a4ed773339cab64713c8f372b29e20cba298ca4

Last affected

2af4e887ede2b38a6c8d4c8d32f1e2177ea1bc24

Last affected

2b87c28313b36f4a8f85dad8af04aad03117e139

Last affected

2db4f6c01283e7491c3ee3b7507e59e5367df0ea

Last affected

2eb8714f7c74342bb5bef4f54570f289cc43cc8b

Last affected

2f573737b0360acc150110f11c6038bf072f1d30

Last affected

2f9a1a6d749f5518dc64ef4b043abb27f263d290

Last affected

2fd9440b5809e4a1a8b075867c902bd6a9965e13

Last affected

33a0d64eab3db2dc863b37ce693f32e7a8fc3202

Last affected

3585f89d44655687c55176e74bae4c0b5b5e77db

Last affected

35d74f5d4e15903c66abe602432df9e04049edb5

Last affected

37cde9225d9526e465698b958a6720d8e33709be

Last affected

3909aa2e73f09988c1b825bd8a09404e7966771d

Last affected

39df1c5a06b3e0155b9f28118b842ce45fbc8e94

Last affected

3b1c3e8283ebc2d1f5f241e042a828ed43cc9731

Last affected

3c4b64351bc44b26fdfbb9101501ad8e485c9e11

Last affected

3d32a671506472457298f7ab64f6efb84088bd61

Last affected

3f2411a18dd2c71225a706af2fed6e2e719da727

Last affected

4205e661092e4e469a5e6f50f860202032bef2c3

Last affected

45e0392397605b8c8d0d975c63e21dd7b2c951de

Last affected

47febcb9277f71089d4c072145b8e0d1b8338415

Last affected

49c18628e9b55cd74d7cbd46fb899a5dbb1d05d1

Last affected

4ab2002a77ea606282631f96de73009e7b60d45a

Last affected

4c348e78e02c291e997abacf8ea00376b23efebb

Last affected

4d985c171d92eed50b95f542c4c15b60c84d188f

Last affected

4efe7bf05179c25b96c6a0dea401d4847c7737af

Last affected

50f15e8d121d5ba7b5eb99aab25fe6650655f3e6

Last affected

552cf009c0939c8b6597708135412bdc596df4bb

Last affected

59b6e5db769d77f5f2ba41869fbcab0ae6e98696

Last affected

5a25b825276c8df42d7d10579957f26d3c777fbf

Last affected

5b447785b61a68b24c2c1672f19659476e9b9804

Last affected

5cc6bd8fe6a4ee99ecb05178e30ca35e07ba8e4f

Last affected

5e0c36bb87280122c60f0be52ff420a7ef244f72

Last affected

614fc2b6ee64a966c67e11cf04c605afde7b2e30

Last affected

61a50ebecf19f7ca9305a10fb1a2490d76f44550

Last affected

63d46b4e7a9b022b2cc8f870c9598afc57111677

Last affected

658f72cb71d8b5d4063e1ec70588cd55a4c52bc2

Last affected

674742f7fffefb7445ad493a6d5aaf42f39e12ed

Last affected

6802552203878e1c33e1812ad60a68db30d2fa24

Last affected

684b0dde49a68d4bcfb70ca6ce2c27f6bcddaad7

Last affected

6e27c017c73d2eaf74631d93dfb8aaf756a517ac

Last affected

6e33ac9205a56fc4232894cfdd13cf216f7662e0

Last affected

7032890c9e21d69a628b40612aa3d86147c542d9

Last affected

705735bb2bc117daa538de446da513beff02c5b8

Last affected

7430e196d12454544c183259ed442fc1cab8dc70

Last affected

7792775db142f515b2701e41ee25ae699ad57e4f

Last affected

79ceeea8f80bac8c8d5870490a013036bd83e510

Last affected

7d40aebf048ce13eccc3bf44f58bb61e67f27c4f

Last affected

7d7b52c434eb23ef470ad51d08ee4029a7078b78

Last affected

7d9a0a89df7e81b6bc821e92ebdda56e7f865a4b

Last affected

7dbe77d63946ce204611a75d5f79d37f9d624ee1

Last affected

7e17de3d6634bcfcafe3e688807665e404580475

Last affected

7f636d8a57264f21be9b8f546036f0acf5d3c62d

Last affected

7f9db93d8afd8879b6e5583d4556d4626d7f02ba

Last affected

7fc2c4b7843f06a1f421fadbf15a3e2afef0e1fb

Last affected

82e513d699311c1e5b1b96639147da2b9a4441e8

Last affected

85335355efb2d7914a1fe20ed31afcef15fd210c

Last affected

8685f96aaa8a98f4ef437bdc430d7f59ce7b53d0

Last affected

8aa14111af9ddf8909c71f86929ed1d4697466a9

Last affected

8b8d8a305b8579c4b89aad9ddd9449fcf849f130

Last affected

8ed31147ca2cac0efe354faa75249bf08b362af7

Last affected

8ed9689bbffbd84451287a2687872b38d4fc7e7d

Last affected

8effd766a94a3e12392975551dd3827568f439f7

Last affected

8fe7e4679a9caf62d4e86419d2746d0feb56270c

Last affected

92876c1c2a7c361108df6586387a208f67bec1cd

Last affected

930582391da595e850a9c1ee3b6fe9445855c9bf

Last affected

930bd0a821e3271f4aa39bef9f961ac51e358871

Last affected

933356d01000d7554810d34457a86e6d629fb026

Last affected

93fdd80012ed2ede44844f458136970020e7f718

Last affected

9528429f4c9d58516525224b24ff566e189c1398

Last affected

968f188ccf2eebe6834afa4411a382ad4e5b95e4

Last affected

97a081e71419f1b5fbe721302db55d459be82ce3

Last affected

9eb27e03314eb37c3dd9fc9be63b85651346f70f

Last affected

9f52e16c269a3c18d9f50f92c4553e8e6d72e838

Last affected

a06b72ee1e806d783e1a9af1ab61e544278be55a

Last affected

a07795c6975b9d35ab9e1ac931748765acd2e9c3

Last affected

a0b9ab019832207882dfb1c6ace1f8c920074ce9

Last affected

a0fb436eda914dca26e96d304d3c9daca2be54de

Last affected

a254eba1d54a43c012435ee14b7a3d949af9972b

Last affected

a2b5d4fa545dcd95535b713f5d9b906fa13c28d5

Last affected

a33aa668a56760ef54ebe78bd878809910398b54

Last affected

a663c6ac431862eb0ff37d61998446a4a8f3f595

Last affected

a6ac89c740a9a8e9ee0e008e12df3998ea6a2492

Last affected

a92aa59c1df5092ad92b7fd1641841bf31f063fb

Last affected

ac0f73694b59317f776ea2f4b8f777327def154e

Last affected

adf51fff8f5264aae1ea6cbe7cb90ffdd5dd28af

Last affected

affbc6907eb544bc6e049085de91002ca24ff930

Last affected

b0614ede8b5b1e78c202652066ecc75f18eb5a87

Last affected

b20b86c0110ff91b49a6e8fe53872557153fca00

Last affected

b40583a6e7b4bcc930cd0dd7954336bfdee879d3

Last affected

b5b3cf89410fecfd7f4a689e6947e7aff008f086

Last affected

b633f5ac9497824f5bdd67657a04c94aabc88e0c

Last affected

b634297c8c7a22a6e62fd7150dea185bebf2129e

Last affected

b8336252bed3de5a7d0da8a2bfc98f6547cdfb6d

Last affected

bbe6d18471f4a2dee52959a462163f3ac6b20b32

Last affected

bda53c1fe8bc378c64142da595f95605335ea281

Last affected

be10e65384ecaf320aec5e8a0598db618ec28084

Last affected

bf004c4584649d080979c4f877a6e9d3e793467c

Last affected

bf9a299c759d612386f0c2293f9a490b6fd79bb1

Last affected

c0cf3631991c2e85fb23c9e83dc8e185d129aa1b

Last affected

c0e30d6457a080e43665dbe60226e6437db9f004

Last affected

c1b521ad109122b09202e0cbf4018495bed6243b

Last affected

c1c8b3c5f36d46b11e49216ec03e438aee88aa2f

Last affected

c30613f7923ddb339dd30b9e1ce7cb18d15f75dc

Last affected

c41eb44de9da1614b86fe3b5d0bf535c17e2e656

Last affected

c45c3b55247f5735f16ebfa90b38a93913dfcee6

Last affected

c5a7c007aa7c1369e48d6db1c1c2f885371c1f51

Last affected

c6d6dd133c3db3b202f1f0d457780c9a6d841e0f

Last affected

c8107eefe9ea1f336fc0eafc0a215381a568f087

Last affected

c90ce6f6c254ce6ddc032c64fe3b10e7eeb0a846

Last affected

caaf2326d01b555d652b821f6cf0412746055fd7

Last affected

cb5d32bd705344af7241d1769b12d2e3b62da56e

Last affected

cc1106a06ac487e54c8222f30b6cc477d90986e1

Last affected

ceb4fdd341abc0e7e06a7d58767cc082dadbd32c

Last affected

d2cd4e58d8bb442bc13d3bd10879d3565fc78ab2

Last affected

d3b0e8ed7a8aa5440305147545e22ce6b5d9cdba

Last affected

d838fa44004f18e291a56ff2dabe6f83b60cd577

Last affected

d880cb4af7ec79941688bf7a93e710321b618795

Last affected

d95f2fd9793806d400155a97e4d15bf0f33d08f9

Last affected

dabf482ce43ef37f4cef7a85e7971382b506f5c8

Last affected

dbaa5a81dbfe8a5f079ca35244cdc227c9e22873

Last affected

dbead3dd974c8ebf16577f579dccfb75de53b478

Last affected

de9145e0febe6e2c83628821f4906acd89c39515

Last affected

df5493573af6efba1fb8ec7f852e85b611eb2fcc

Last affected

e14cc5edb2176fc0e8153daf27d74b958f93e639

Last affected

e1736c6dd59d0ce46f51432c9c18de7ac5f78241

Last affected

e2453cf2d10c7f659f6567a6fd0a01420e82b92e

Last affected

e343034f6681afff6a0d070c30dbd8c81914f9bc

Last affected

e3830dec049a6b5316bcd609691df7c2d71ed4b8

Last affected

e3b1f2dfd87b098b22829ddba204a3d19c38306a

Last affected

e5a3b1d0e751e1d9799dfeddb31d3091b31a6e96

Last affected

e6c7e7d08f4652f4382d72100739116cf5586932

Last affected

e70b66157732cfba5e2c94030f2666030851335c

Last affected

e7305c01f21a8e935e449e19652f96a582bd76dd

Last affected

e93726aec2cf7330c96843679bb6984469cfe5af

Last affected

eaaf1789b031583a77b377c425b4870694e7ef69

Last affected

ec0088f7fb1d4bc744657403d2607a1ae9547c27

Last affected

ec97c41ac817bce13d8bd9436c35ad3ef95a9f72

Last affected

ee73af1d88c9ff6db90f70f934f5ea57b8ab0625

Last affected

ee7aa21e683f0b46705effb0cf9a8e0af59b0160

Last affected

f1bfc6169ba6d6a74fcbe38b57cfd9e5607caec3

Last affected

f3969e49d194467a3cf5316c6ab6d5d9db2eba41

Last affected

f6ad2915b308e4132df613dce59d994656f7b7a8

Last affected

f6f483170c44642fa0267c96e6a40d8691f32d34

Last affected

f8d503582c3506e2a65e1ec96b4f2c0833623666

Last affected

f8fb5a74b32637bd700117d65f0b53d522e1b85d

Last affected

fad0410486b3a47743331f14fcb565b79357887c

Last affected

fbdaade2645d954d9bd0191dd60a218acfa93ba1

Last affected

fd869fd9a4a56c7fe08b728f8b086f1341950095

Last affected

fdde690e0fa2e58bf45ea2bf83962bb1c261d6e0

Last affected

fea3b67d432b51a8d8cd5bd544acee6f66d9b25c

Last affected

ff4dbeaf3894d28de5c9e2a718702442acddcb29

Affected versions

11.*

11.2.0-rc1

11.6.0

11.6.0-rc1

11.6.0-rc2

13.*

13.1.0-rc1

13.1.0-rc2

13.12.0

13.12.0-rc1

13.13.0

13.13.0-rc1

13.13.0-rc2

13.8.0-rc1

certified/11.*

certified/11.6-cert12

certified/11.6-cert13

certified/11.6-cert14

certified/11.6-cert14-rc1

certified/11.6-cert14-rc2

certified/13.*

certified/13.13-cert1-rc1

certified/13.13-cert1-rc2

certified/13.13-cert1-rc3

certified/13.13-cert1-rc4