PT-2016-3318 · Libevent+5 · Libevent+5
Huzaifa Sidhpurwala
·
Publicado
2016-12-31
·
Atualizado
2024-10-21
·
CVE-2016-10196
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
libevent versions prior to 2.1.6-beta
Description
The issue is related to a stack-based buffer overflow in the
evutil parse sockaddr port function, which can be exploited by attackers to cause a denial of service, resulting in a segmentation fault. This can be achieved by providing a long string in brackets in the ip as string argument. The vulnerability allows remote attackers to disrupt service.Recommendations
For versions prior to 2.1.6-beta, update to version 2.1.6-beta or later to resolve the issue. As a temporary workaround, consider restricting input to the
evutil parse sockaddr port function to prevent long strings in brackets from being processed.Exploit
Correção
DoS
Memory Corruption
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Red Hat
Suse
Ubuntu
Libevent