PT-2019-14576 · Gnu · Gnu Serveez

Publicado 2019-11-20 · Atualizado 2020-08-24 · CVE-2019-16200

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GNU Serveez versions prior to 0.2.3

Description The issue allows an attacker to send an HTTP POST request to the "/cgi-bin/reader" API endpoint, including a Content-length header with a large positive value that, when represented in 32-bit binary, evaluates to a negative number. This can lead to a heap-based buffer over-read, potentially causing information leakage. The problem is rooted in the http cgi write function, although exploitation may appear to originate from the svz envblock add function.

Recommendations For GNU Serveez versions prior to 0.2.3, update to version 0.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/cgi-bin/reader" API endpoint to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-681

Identificadores relacionados

CVE-2019-16200

Produtos afetados

Gnu Serveez

Referências · 3

• 🔥 https://github.com/agadient/SERVEEZ-CVE · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-16200 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-16200 · Aviso do Fabricante