PT-2019-15175 · Hydra · Hydra

Felix Blanco + 2 · Publicado 2019-10-12 · Atualizado 2019-10-17 · CVE-2019-17502

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Hydra versions prior to 0.1.9

Description The issue arises from a NULL pointer dereference and daemon crash when processing POST requests that lack a Content-Length header. This is attributed to the process header end() function, which calls boa atoi(), ultimately leading to atoi() being called on a NULL pointer. The files read.c, request.c, and util.c are involved in this process.

Recommendations For Hydra versions prior to 0.1.9, consider updating to a version that includes a fix for this issue to prevent daemon crashes when handling specific POST requests. As a temporary workaround, consider restricting access to the process header end() function or ensuring that all POST requests include a valid Content-Length header until a patch is available.

Exploit

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2019-17502

Produtos afetados

Hydra

Referências · 4

• 🔥 https://gist.github.com/fxb6476/0b9883a88ff2ca40de46a8469834e16c · Exploit
• http://hydra.hellug.gr · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-17502 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-17502 · Aviso do Fabricante