Infinite Loop Vulnerability in Asterisk Open Source TCP/TLS Connections
CVE-2018-12228

6.5MEDIUM

Key Information:

Vendor

Asterisk

Status
Open Source
Vendor
CVE Published:
12 June 2018

What is CVE-2018-12228?

A vulnerability in Asterisk Open Source 15.x prior to version 15.4.1 allows an attacker connected via TCP/TLS to disrupt the service. When a client abruptly disconnects or sends a specially crafted message, Asterisk encounters an infinite loop while attempting to read from the data stream, resulting in system unresponsiveness and denial of service. This vulnerability poses significant risks, particularly in environments where reliable communication is critical.

References

http://www.securityfocus.com/bid/104457
vdb-entryx_refsource_BID
https://issues.asterisk.org/jira/browse/ASTERISK-27807
x_refsource_CONFIRM
http://downloads.asterisk.org/pub/security/AST-2018-007.html
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.