vulnerability
FreeBSD: VID-fab87bff-3ce5-11e7-bf9d-001999f8d30b: asterisk -- Memory exhaustion on short SCCP packets
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 8 | (AV:N/AC:L/Au:N/C:N/I:N/A:C) | May 19, 2017 | May 20, 2017 | Dec 10, 2025 |
Severity
8
CVSS
(AV:N/AC:L/Au:N/C:N/I:N/A:C)
Published
May 19, 2017
Added
May 20, 2017
Modified
Dec 10, 2025
Description
The Asterisk project reports: A remote memory exhaustion can be triggered by sending an SCCP packet to Asterisk system with "chan_skinny" enabled that is larger than the length of the SCCP header but smaller than the packet length specified in the header. The loop that reads the rest of the packet doesn't detect that the call to read() returned end-of-file before the expected number of bytes and continues infinitely. The "partial data" message logging in that tight loop causes Asterisk to exhaust all available memory.
Solution
freebsd-upgrade-package-asterisk13
References
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.