PT-2019-15147 · Titania · Nipper-Ng

Mavlevin · Publicado 2019-10-22 · Atualizado 2019-11-18 · CVE-2019-17424

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nipper-ng version 0.11.10

Description A stack-based buffer overflow in the processPrivilage() function allows remote attackers to achieve Remote Code Execution or Denial Of Service via a crafted file. This issue is related to the processing of firewall configuration files.

Recommendations For nipper-ng version 0.11.10, consider disabling the processPrivilage() function as a temporary workaround until a patch is available. Restrict access to the IOS/process-general.c module to minimize the risk of exploitation. Avoid using crafted firewall configuration files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2019-17424

Produtos afetados

Nipper-Ng

Referências · 9

• 🔥 https://github.com/guywhataguy/CVE-2019-17424 · Exploit
• 🔥 https://github.com/mavlevin/CVE-2019-17424 · Exploit
• 🔥 https://exploit-db.com/exploits/47673 · Exploit
• 🔥 https://blog.vastart.dev/2019/10/stack-overflow-cve-2019-17424.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-17424 · Aviso do Fabricante
• https://code.google.com/archive/p/nipper-ng/source/default/source · Nota
• https://twitter.com/va_start · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-17424 · Nota de Segurança
• http://packetstormsecurity.com/files/155378/nipper-ng-0.11.10-Remote-Buffer-Overflow.html · Nota