PT-2002-2844 · Nylon · Nylon

Published 2002-12-31 · Updated 2017-07-11 · CVE-2002-2124

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: nylon version 0.2

Description: The issue concerns the recvn and sendn functions, which do not properly handle the case when the recv function call returns 0. This oversight allows remote attackers to trigger a denial of service by closing the connection during the execution of recv, resulting in an infinite loop and excessive CPU consumption.

Recommendations: For nylon version 0.2, consider modifying the recvn and sendn functions to correctly handle the case when the recv function call returns 0, thus preventing the infinite loop and CPU consumption. As a temporary workaround, consider implementing a timeout or a mechanism to detect and handle closed connections to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-2124

Affected Products

Nylon

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2002-2124 · Security Note
• http://secunia.com/advisories/7281 · Vendor Advisory
• http://securityfocus.com/bid/5938 · Patch
• http://security-express.com/archives/bugtraq/2002-10/0146.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/10334 · Note