PT-2014-7102 · Facebook · Hhvm

Publicado 2014-12-28 · Atualizado 2014-12-30 · CVE-2014-6229

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions HHVM versions prior to 3.3.0

Description The issue allows remote attackers to obtain sensitive information by leveraging read access beyond the end of a certain key string. This is due to the HashContext class in hphp/runtime/ext/ext hash.cpp incorrectly expecting that the key string uses '0' for termination. Additionally, it makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging truncation of a string containing an internal '0' character.

Recommendations For versions prior to 3.3.0, update to version 3.3.0 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-6229

Produtos afetados

Hhvm

Referências · 3

• https://github.com/facebook/hhvm/commit/7135ec229882370a00411aa50030eada6034cc1b · Nota
• http://hhvm.com/blog/6239/hhvm-3-3-0 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-6229 · Nota de Segurança