Test ID:	1.3.6.1.4.1.25623.1.0.140494
Category:	General
Title:	Asterisk CDR Buffer Overflow Vulnerability (AST-2017-010)
Summary:	Asterisk is prone to a buffer overflow vulnerability in CDR's; set user.
Description:	Summary: Asterisk is prone to a buffer overflow vulnerability in CDR's set user. Vulnerability Insight: No size checking is done when setting the user field for Party B on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. This currently affects any system using CDR's that also make use of the following: - The 'X-ClientCode' header within a SIP INFO message when using chan_sip and the 'useclientcode' option is enabled (note, it's disabled by default). - The CDR dialplan function executed from AMI when setting the user field. - The AMI Monitor action when using a long file name/path. Affected Software/OS: Asterisk Open Source 13.x, 14.x, 15.x and Certified Asterisk 13.13. Solution: Update to version 13.18.1, 14.7.1, 15.1.1, 13.13-cert7 or later. CVSS Score: 6.5 CVSS Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2017-16671 BugTraq ID: 101760 http://www.securityfocus.com/bid/101760 Debian Security Information: DSA-4076 (Google Search) https://www.debian.org/security/2017/dsa-4076 https://security.gentoo.org/glsa/201811-11
Copyright	Copyright (C) 2017 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.