CVE-2018-7285

{"id": "CVE-2018-7285", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": true, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-02-22T00:29:01.063", "references": [{"url": "http://downloads.asterisk.org/pub/security/AST-2018-001.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/103149", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id/1040415", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "A NULL pointer access issue was discovered in Asterisk 15.x through 15.2.1. The RTP support in Asterisk maintains its own registry of dynamic codecs and desired payload numbers. While an SDP negotiation may result in a codec using a different payload number, these desired ones are still stored internally. When an RTP packet was received, this registry would be consulted if the payload number was not found in the negotiated SDP. This registry was incorrectly consulted for all packets, even those which are dynamic. If the payload number resulted in a codec of a different type than the RTP stream (for example, the payload number resulted in a video codec but the stream carried audio), a crash could occur if no stream of that type had been negotiated. This was due to the code incorrectly assuming that a stream of that type would always exist."}, {"lang": "es", "value": "Se ha descubierto un problema de acceso a puntero NULL en las versiones 15.x de Asterisk hasta la versi\u00f3n 15.2.1. El soporte RTP en Asterisk mantiene su propio registro de c\u00f3decs din\u00e1micos y n\u00fameros de carga \u00fatil deseados. Aunque una negociaci\u00f3n SDP puede resultar en que un c\u00f3dec emplee un n\u00famero de carga \u00fatil diferente, aquellos que se deseen se siguen almacenando internamente. Cuando se recib\u00eda un paquete RTP, este registro ser\u00eda consultado si el n\u00famero de carga \u00fatil no se encontraba en el SDP negociado. Este registro se consultaba err\u00f3neamente para todos los paquetes, incluso los din\u00e1micos. Si el n\u00famero de carga \u00fatil resultaba en un c\u00f3dec con tipo diferente a la transmisi\u00f3n RTP (por ejemplo, el n\u00famero de payload resultaba en un c\u00f3dec de v\u00eddeo, pero la transmisi\u00f3n conten\u00eda audio), podr\u00eda ocurrir un cierre inesperado si no se hab\u00eda negociado una transmisi\u00f3n de ese tipo. Esto se debe a que el c\u00f3digo asume err\u00f3neamente que una transmisi\u00f3n de este tipo existir\u00eda siempre."}], "lastModified": "2018-03-21T12:56:56.930", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D63485A9-4464-49C7-ACF8-826303D8C152", "versionEndIncluding": "15.2.1", "versionStartIncluding": "15.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}