PT-2012-1091 · Trousers+2 · Trousers+2
Andy Lutomirski
·
Published
2012-11-26
·
Updated
2020-08-17
·
CVE-2012-0698
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
TrouSerS versions prior to 0.3.10
trousers-devel version 0.3.13
trousers-static version 0.3.13
trousers-debuginfo version 0.3.13
trousers version 0.3.13
Description
The issue allows remote attackers to cause a denial of service, potentially leading to disruption of protected information availability. This can be exploited remotely, with the vulnerable component being the tcsd in TrouSerS. The exploitation involves a crafted type offset value in a TCP packet to port 30003.
Recommendations
For TrouSerS versions prior to 0.3.10, update to version 0.3.10 or later to resolve the issue.
For trousers-devel version 0.3.13, consider disabling the service until a patch is available.
For trousers-static version 0.3.13, restrict access to the vulnerable module to minimize the risk of exploitation.
For trousers-debuginfo version 0.3.13, avoid using the vulnerable package until the issue is resolved.
For trousers version 0.3.13, consider applying configuration changes to mitigate the risk of exploitation.
Exploit
Fix
DoS
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Centos
Red Hat
Trousers