CVE-2017-11521 - Vulnerability Details - OpenCVE

The SdpContents::Session::Medium::parse function in resip/stack/SdpContents.cxx in reSIProcate 1.10.2 allows remote attackers to cause a denial of service (memory consumption) by triggering many media connections.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Debian	Debian Linux
Resiprocate	Resiprocate

Configuration 1 [-]

cpe:2.3:a:resiprocate:resiprocate:1.10.2:*:*:*:*:*:*:*

Configuration 2 [-]

OR	cpe:2.3:o:debian:debian_linux:8.0:::::::*
	cpe:2.3:o:debian:debian_linux:9.0:::::::*

No data.

References

Link	Providers
https://github.com/resiprocate/resiprocate/pull/88
https://list.resiprocate.org/archive/resiprocate-users/msg02701.html
https://lists.debian.org/debian-lts-announce/2018/07/msg00031.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00029.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2017-07-22T18:00:00

Updated: 2024-08-05T18:12:40.129Z

Reserved: 2017-07-22T00:00:00

Link: CVE-2017-11521

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2017-07-22T18:29:00.197

Modified: 2025-04-20T01:37:25.860

Link: CVE-2017-11521

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-07-22T00:00:00", "descriptions": [{"lang": "en", "value": "The SdpContents::Session::Medium::parse function in resip/stack/SdpContents.cxx in reSIProcate 1.10.2 allows remote attackers to cause a denial of service (memory consumption) by triggering many media connections."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-12-29T15:06:14", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "[security] 20170806 SDP Parser: out-of-memory condition (CVE-2017-11521)", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://list.resiprocate.org/archive/resiprocate-users/msg02701.html"}, {"name": "[debian-lts-announce] 20180724 [SECURITY] [DLA 1439-1] resiprocate security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00031.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/resiprocate/resiprocate/pull/88"}, {"name": "[debian-lts-announce] 20211229 [SECURITY] [DLA 2865-1] resiprocate security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00029.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-11521", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The SdpContents::Session::Medium::parse function in resip/stack/SdpContents.cxx in reSIProcate 1.10.2 allows remote attackers to cause a denial of service (memory consumption) by triggering many media connections."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "[security] 20170806 SDP Parser: out-of-memory condition (CVE-2017-11521)", "refsource": "MLIST", "url": "https://list.resiprocate.org/archive/resiprocate-users/msg02701.html"}, {"name": "[debian-lts-announce] 20180724 [SECURITY] [DLA 1439-1] resiprocate security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00031.html"}, {"name": "https://github.com/resiprocate/resiprocate/pull/88", "refsource": "CONFIRM", "url": "https://github.com/resiprocate/resiprocate/pull/88"}, {"name": "[debian-lts-announce] 20211229 [SECURITY] [DLA 2865-1] resiprocate security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00029.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T18:12:40.129Z"}, "title": "CVE Program Container", "references": [{"name": "[security] 20170806 SDP Parser: out-of-memory condition (CVE-2017-11521)", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://list.resiprocate.org/archive/resiprocate-users/msg02701.html"}, {"name": "[debian-lts-announce] 20180724 [SECURITY] [DLA 1439-1] resiprocate security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00031.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/resiprocate/resiprocate/pull/88"}, {"name": "[debian-lts-announce] 20211229 [SECURITY] [DLA 2865-1] resiprocate security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00029.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-11521", "datePublished": "2017-07-22T18:00:00", "dateReserved": "2017-07-22T00:00:00", "dateUpdated": "2024-08-05T18:12:40.129Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:resiprocate:resiprocate:1.10.2:*:*:*:*:*:*:*", "matchCriteriaId": "DA289E6F-9411-4E86-BE4C-066F226464F7", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SdpContents::Session::Medium::parse function in resip/stack/SdpContents.cxx in reSIProcate 1.10.2 allows remote attackers to cause a denial of service (memory consumption) by triggering many media connections."}, {"lang": "es", "value": "La funci\u00f3n SdpContents::Session::Medium::parse en el archivo resip/stack/SdpContents.cxx en reSIProcate versi\u00f3n 1.10.2, permite a los atacantes remotos causar una denegaci\u00f3n de servicio (consumo de memoria) mediante la activaci\u00f3n de muchas conexiones de medios."}], "id": "CVE-2017-11521", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-07-22T18:29:00.197", "references": [{"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/resiprocate/resiprocate/pull/88"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://list.resiprocate.org/archive/resiprocate-users/msg02701.html"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00031.html"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00029.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/resiprocate/resiprocate/pull/88"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://list.resiprocate.org/archive/resiprocate-users/msg02701.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00031.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00029.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "nvd@nist.gov", "type": "Primary"}]}