PT-2023-9157 · Ofono+4 · Ofono+4
Sandipan Roy
·
Publicado
2023-05-10
·
Atualizado
2025-08-07
·
CVE-2023-4235
CVSS v3.1
8.1
Alta
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ofono (affected versions not specified)
Description
A flaw was found in ofono, an Open Source Telephony on Linux, where a stack overflow bug is triggered within the
decode deliver report() function during SMS decoding. This issue is related to the parsing of SMS PDUs and can be exploited remotely without requiring authentication. The attack scenario is assumed to be accessible from a compromised modem, a malicious base station, or via SMS. A bound check for the memcpy length was forgotten in decode deliver report(), unlike in decode submit().Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Astra Linux
Debian
Linuxmint
Ubuntu
Ofono