PT-2018-9421 · Minisphere · Minisphere

Xiaoyinl · Publicado 2018-06-26 · Atualizado 2018-08-28 · CVE-2018-1000524

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions miniSphere versions prior to 5.2.10

Description The issue is related to an Integer Overflow in the layer resize() function in map engine.c, which can lead to a remote denial of service. This can be exploited by loading a specially-crafted map that calls SetLayerSize in its entry script.

Recommendations For miniSphere versions prior to 5.2.10, update to version 5.2.10 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the layer resize() function or restricting the loading of maps that call SetLayerSize in their entry scripts until a patch is applied.

Exploit

Correção

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

CVE-2018-1000524

Produtos afetados

Minisphere

Referências · 4

• 🔥 https://github.com/fatcerberus/minisphere/commit/252c1ca184cb38e1acb917aa0e451c5f08519996 · Exploit
• https://github.com/fatcerberus/minisphere/pull/268 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000524 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1000524 · Aviso do Fabricante