CVE-2017-17090

An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and older, and Certified Asterisk 13.13-cert7 and older. If the chan_skinny (aka SCCP protocol) channel driver is flooded with certain requests, it can cause the asterisk process to use excessive amounts of virtual memory, eventually causing asterisk to stop processing requests of any kind.

• CWE-459

• http://downloads.digium.com/pub/security/AST-2017-013.htmlVendor Advisory
• http://www.securityfocus.com/bid/102023Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039948
• https://issues.asterisk.org/jira/browse/ASTERISK-27452Issue Tracking, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2017/12/msg00028.html
• https://www.debian.org/security/2017/dsa-4076
• https://www.exploit-db.com/exploits/43992/
• http://downloads.digium.com/pub/security/AST-2017-013.htmlVendor Advisory
• http://www.securityfocus.com/bid/102023Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039948
• https://issues.asterisk.org/jira/browse/ASTERISK-27452Issue Tracking, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2017/12/msg00028.html
• https://www.debian.org/security/2017/dsa-4076
• https://www.exploit-db.com/exploits/43992/

Published

Dec 2, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-17084In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the IWARP_M…
• CVE-2017-17085In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Saf…
• CVE-2017-17086Indeo Otter through 1.7.4 mishandles a "</script>" substring…
• CVE-2017-17087fileio.c in Vim prior to 8.0.1263 sets the group ownership o…5.5
• CVE-2017-17088The Enterprise version of SyncBreeze 10.2.12 and earlier is …
• CVE-2017-17089custom/run.cgi in Webmin before 1.870 allows remote authenti…
• CVE-2017-17091wp-admin/user-new.php in WordPress before 4.9.1 sets the new…
• CVE-2017-17092wp-includes/functions.php in WordPress before 4.9.1 does not…
• CVE-2017-17093wp-includes/general-template.php in WordPress before 4.9.1 d…
• CVE-2017-17094wp-includes/feed.php in WordPress before 4.9.1 does not prop…
• CVE-2017-17095tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote at…
• CVE-2017-17096Cross-site scripting (XSS) vulnerability in the Content Card…