PT-2023-10267 · Ayttm · Ayttm

Kapil A · Publicado 2023-03-05 · Atualizado 2024-05-17 · CVE-2015-10088

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ayttm versions up to 0.5.0.89

Description A critical vulnerability was found in ayttm, affecting the function http connect in the library libproxy/proxy.c. The manipulation leads to a format string issue, which can be initiated remotely. The complexity of an attack is rather high, and the exploitability is difficult.

Recommendations To fix this issue, it is recommended to apply a patch named 40e04680018614a7d2b68566b261b061a0597046 for versions up to 0.5.0.89. As a temporary workaround, consider disabling the http connect function in the libproxy/proxy.c library until a patch is available.

Correção

Use of Externally-Controlled Format String

Enumeração de Fraquezas

CWE-134

Identificadores relacionados

CVE-2015-10088

Produtos afetados

Ayttm

Referências · 10

• https://github.com/ayttm/ayttm/commit/40e04680018614a7d2b68566b261b061a0597046 · Correção
• https://vuldb.com/?id.222267 · Nota
• https://t.me/cvenotify/45535 · Publicação no Telegram
• https://t.me/cibsecurity/59426 · Publicação no Telegram
• https://cve.org/CVERecord?id=CVE-2015-10088 · Nota de Segurança
• https://ubuntu.com/security/CVE-2015-10088 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-10088 · Aviso do Fabricante
• https://vuldb.com/?ctiid.222267 · Nota
• https://sourceforge.net/p/ayttm/mailman/message/34397158 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-10088 · Nota de Segurança