PT-2023-25003 · Sliver · Sliver
Tangent65536
·
Publicado
2023-06-21
·
Atualizado
2026-03-17
·
CVE-2023-34758
CVSS v4.0
9.2
Crítica
| Vetor | AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Sliver versions 1.5.x through 1.5.39
Description
The issue is related to an improper cryptographic implementation, allowing attackers to execute a man-in-the-middle attack via intercepted and crafted responses. This enables attackers to execute arbitrary code on implanted devices. The estimated number of potentially affected devices is not specified. There is a mention of a threat actor's toolkit leveraging Sliver, but no specific details about real-world incidents where this issue was exploited are provided.
Recommendations
For Sliver versions 1.5.x through 1.5.39, update to a version later than 1.5.39 to resolve the issue. As a temporary workaround, consider restricting access to the implant binary to minimize the risk of exploitation. Avoid using the vulnerable cryptographic implementation until the issue is resolved. At the moment, there is no additional information about other mitigation measures.
Correção
Use of a Broken Cryptographic Algorithm
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Sliver