### [CVE-2018-17281](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17281)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.

### POC

#### Reference
- http://packetstormsecurity.com/files/149453/Asterisk-Project-Security-Advisory-AST-2018-009.html
- http://packetstormsecurity.com/files/149453/Asterisk-Project-Security-Advisory-AST-2018-009.html

#### Github
No PoCs found on GitHub currently.