CVE-2017-14603

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-10-10 · updated 2026-06-17
Weakness: CWE-200

Description

In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2 and Certified Asterisk 11.x before 11.6-cert18 and 13.x before 13.13-cert6, insufficient RTCP packet validation could allow reading stale buffer contents and when combined with the "nat" and "symmetric_rtp" options allow redirecting where Asterisk sends the next RTCP report.

Affected products

Digium Asterisk: 13.0.0, 13.0.0-beta1, 13.0.0-beta2, 13.0.0-beta3, 13.0.1, 13.0.2 (+155)
Digium Certified Asterisk: 11.6-cert1, 11.6-cert1_rc1, 11.6-cert1_rc2, 11.6-cert10, 11.6-cert11, 11.6-cert12 (+22)

References

http://downloads.asterisk.org/pub/security/AST-2017-008.html
http://www.debian.org/security/2017/dsa-3990
https://issues.asterisk.org/jira/browse/ASTERISK-27274
http://downloads.asterisk.org/pub/security/AST-2017-008.html
http://www.debian.org/security/2017/dsa-3990
https://issues.asterisk.org/jira/browse/ASTERISK-27274

Get alerted when CVE-2017-14603 or the next vulnerability affects your stack