PT-2019-9371 · Shellinabox+1 · Shellinabox+1

Imre Rad · Publicado 2019-03-17 · Atualizado 2024-08-19 · CVE-2018-16789

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions shellinabox versions prior to 2.20

Description The issue is related to an implementation flaw in the HTTP request parsing logic. By sending a crafted multipart/form-data HTTP request, an attacker could exploit this to force the service into an infinite loop, exhausting available CPU resources and taking the service down.

Recommendations For versions prior to 2.20, update to version 2.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the service to minimize the risk of exploitation.

Exploit

Correção

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

ALT-PU-2021-1129

ALT-PU-2021-1143

ALT-PU-2024-11158

CVE-2018-16789

Produtos afetados

Alt Linux

Shellinabox

Referências · 17

• 🔥 http://packetstormsecurity.com/files/149978/Shell-In-A-Box-2.2.0-Denial-Of-Service.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2018/Oct/50 · Exploit
• https://github.com/shellinabox/shellinabox/commit/4f0ecc31ac6f985e0dd3f5a52cbfc0e9251f6361 · Correção
• https://github.com/shellinabox/shellinabox/pull/446 · Nota
• https://cve.org/CVERecord?id=CVE-2018-16789 · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2024-11158 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-16789 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16789 · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2018-16789 · Nota
• https://code.google.com/archive/p/shellinabox/issues · Nota
• https://errata.altlinux.org/ALT-PU-2021-1129 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-16789 · Aviso do Fabricante
• https://errata.altlinux.org/ALT-PU-2021-1143 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-16789 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-16789 · Aviso do Fabricante