THREATPORT/VULNERABILITY/CVE-2017-14099
HIGH SEVERITY

CVE-2017-14099

Asterisk vulnerability

CVSS
7.5
EPSS
4.3%
EPSS pct
90th
Exploited
No known
In res/res_rtp_asterisk.c in Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized data disclosure (media takeover in the RTP stack) is possible with careful timing by an attacker. The "strictrtp" option in rtp.conf enables a feature of the RTP stack that learns the source address of media for a session and drops any packets that do not originate from the expected address. This option is enabled by default in Asterisk 11 and above. The "nat" and "rtp_symmetric" options (for chan_sip and chan_pjsip, respectively) enable symmetric RTP support in the RTP stack. This uses the source address of incoming media as the target address of any sent media. This option is not enabled by default, but is commonly enabled to handle devices behind NAT. A change was made to the strict RTP support in the RTP stack to better tolerate late media when a reinvite occurs. When combined with the symmetric RTP support, this introduced an avenue where media could be hijacked. Instead of only learning a new address when expected, the new code allowed a new source address to be learned at all times. If a flood of RTP traffic was received, the strict RTP support would allow the new address to provide media, and (with symmetric RTP enabled) outgoing traffic would be sent to this new address, allowing the media to be hijacked. Provided the attacker continued to send traffic, they would continue to receive traffic as well.
Affected vendor
Digium
Affected product
Asterisk
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness type (CWE)
  • CWE-200 — Exposure of Sensitive Information
Published
2017-09-02

Risk analysis

Based on its CVSS vector, this vulnerability is exploitable over the network, low attack complexity, requiring no privileges, no user interaction. Successful exploitation leads to high impact to confidentiality.

Its EPSS score of 4.3% reflects a lower probability of exploitation activity in the wild over the next 30 days, placing it above 90% of all scored CVEs.

Check your external exposure to CVE-2017-14099

  • Confirm whether Digium Asterisk is running on any internet-facing host or subdomain.
  • Match discovered service fingerprints against the version affected by CVE-2017-14099.
  • Prioritise remediation if the asset is public, business-critical, or near authentication/payment flows.

How ThreatPort helps with CVE-2017-14099

ThreatPort's external attack surface scanner checks your internet-facing assets — agentlessly, from the outside in — for the exposed services and versions that CVE-2017-14099 affects, then prioritises the finding by real risk using CISA KEV and FIRST.org EPSS.

Run a free external exposure scan

Are you exposed to CVE-2017-14099?

Run an instant, non-intrusive external scan to check your attack surface for CVE-2017-14099.

Start free scan

No credit card. Agentless.

Related vulnerabilities

HIGH
CVE-2002-0931
Myhelpdesk vulnerability
HIGH
CVE-2002-0938
Secure Access Control Server vulnerability
HIGH
CVE-2002-0942
Log Explorer vulnerability