PT-2012-2270 · Libusbmuxd · Usbmuxd

Agostino Sarubbo · Published 2012-10-06 · Updated 2023-02-13 · CVE-2012-0065

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions usbmuxd versions 1.0.5 through 1.0.7

Description A heap-based buffer overflow issue exists in the receive packet function in libusbmuxd/libusbmuxd.c. This allows physically proximate attackers to execute arbitrary code via a long SerialNumber field in a property list.

Recommendations For usbmuxd versions 1.0.5 through 1.0.7, consider updating to a version that contains a fix for this issue, as the current version is affected by the heap-based buffer overflow in the receive packet function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2012-0065

Affected Products

Usbmuxd

References · 15

• 🔥 http://git.marcansoft.com/?p=usbmuxd.git;a=commitdiff;h=f794991993af56a74795891b4ff9da506bc893e6 · Exploit
• https://osv.dev/vulnerability/CVE-2012-0065 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:133 · Vendor Advisory
• http://secunia.com/advisories/47545 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0065 · Security Note
• http://openwall.com/lists/oss-security/2012/01/19/25 · Patch
• http://mandriva.com/security/advisories?name=MDVSA-2012:133 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-0065 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-0065 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72546 · Note
• http://git.marcansoft.com/?p=usbmuxd.git%3Ba=commitdiff%3Bh=f794991993af56a74795891b4ff9da506bc893e6 · Note
• https://bugs.gentoo.org/show_bug.cgi?id=399409 · Note
• https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0228 · Note
• http://securityfocus.com/bid/51573 · Note
• http://openwall.com/lists/oss-security/2012/01/19/26 · Note