FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

asterisk -- Memory exhaustion on short SCCP packets

Affected packages
asterisk13 < 13.15.1


VuXML ID fab87bff-3ce5-11e7-bf9d-001999f8d30b
Discovery 2017-04-13
Entry 2017-05-19

The Asterisk project reports:

A remote memory exhaustion can be triggered by sending an SCCP packet to Asterisk system with "chan_skinny" enabled that is larger than the length of the SCCP header but smaller than the packet length specified in the header. The loop that reads the rest of the packet doesn't detect that the call to read() returned end-of-file before the expected number of bytes and continues infinitely. The "partial data" message logging in that tight loop causes Asterisk to exhaust all available memory.