FreeBSD : asterisk -- Memory exhaustion on short SCCP packets (fab87bff-3ce5-11e7-bf9d-001999f8d30b)

high Nessus Plugin ID 100314

Language:

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

The Asterisk project reports :

A remote memory exhaustion can be triggered by sending an SCCP packet to Asterisk system with 'chan_skinny' enabled that is larger than the length of the SCCP header but smaller than the packet length specified in the header. The loop that reads the rest of the packet doesn't detect that the call to read() returned end-of-file before the expected number of bytes and continues infinitely. The 'partial data' message logging in that tight loop causes Asterisk to exhaust all available memory.

Solution

Update the affected package.

Plugin Details

Severity: High

ID: 100314

File Name: freebsd_pkg_fab87bff3ce511e7bf9d001999f8d30b.nasl

Version: 3.3

Type: local

Family: FreeBSD Local Security Checks

Published: 5/22/2017

Updated: 1/4/2021

Supported Sensors: Nessus

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:asterisk13, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 5/19/2017

Vulnerability Publication Date: 4/13/2017

Detections

Analytics