CVE-2018-12228

An issue was discovered in Asterisk Open Source 15.x before 15.4.1. When connected to Asterisk via TCP/TLS, if the client abruptly disconnects, or sends a specially crafted message, then Asterisk gets caught in an infinite loop while trying to read the data stream. This renders the system unusable.
Infinite Loop
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 64%
VendorProductVersion
sangomaasterisk
15.0 ≤
𝑥
< 15.4.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
asterisk
bullseye
1:16.28.0~dfsg-0+deb11u4
fixed
bullseye (security)
1:16.28.0~dfsg-0+deb11u5
fixed
sid
1:22.0.0~dfsg+~cs6.14.60671435-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
asterisk
eoan
not-affected
disco
not-affected
cosmic
ignored
bionic
not-affected
artful
ignored
xenial
not-affected
trusty
dne
Common Weakness Enumeration
References
http://downloads.asterisk.org/pub/security/AST-2018-007.html
http://www.securityfocus.com/bid/104457
https://issues.asterisk.org/jira/browse/ASTERISK-27807
http://downloads.asterisk.org/pub/security/AST-2018-007.html
http://www.securityfocus.com/bid/104457
https://issues.asterisk.org/jira/browse/ASTERISK-27807