PT-2012-4667 · Dtach · Dtach

Jan Lieskovsky · Published 2012-07-03 · Updated 2012-07-04 · CVE-2012-3368

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions dtach version 0.8

Description The issue is related to an integer signedness error in the attach.c file of dtach. This error allows remote attackers to obtain sensitive information from the daemon stack memory under certain circumstances. The attack can occur when an improper connection-close request is made, and the attacker reads application data afterwards. An example of this attack is demonstrated by running an IRC client in dtach.

Recommendations For dtach version 0.8, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2012-3368

Affected Products

Dtach

References · 9

• 🔥 http://sourceforge.net/tracker/?func=detail&aid=3517812&group_id=36489&atid=417357 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=812551 · Exploit
• http://sourceforge.net/tracker/download.php?group_id=36489&atid=417357&file_id=441195&aid=3517812 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3368 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-3368 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-3368 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3368 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=835849 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=625302 · Note