PT-2014-1916 · Gnustep · Gnustep-Base

Dan Rosenberg · Published 2014-04-28 · Updated 2017-08-29 · CVE-2014-2980

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions gnustep-base versions prior to 1.24.6

Description The issue is related to the improper handling of the file descriptor for the logger in the gdomap component of GNUstep Base. This can be exploited remotely, potentially leading to a denial of service. The exploitation may cause the service to abort when an invalid request is received.

Recommendations For versions prior to 1.24.6, update to version 1.24.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the gdomap service to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-09783

CVE-2014-2980

Affected Products

Gnustep-Base

References · 17

• 🔥 http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/Tools/gdomap.c?r1=37756&r2=37755&pathrev=37756 · Exploit
• https://cve.org/CVERecord?id=CVE-2014-2980 · Security Note
• https://ubuntu.com/security/CVE-2014-2980 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-2980 · Vendor Advisory
• http://secunia.com/advisories/58104 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-2980 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-2980 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2980 · Security Note
• https://bdu.fstec.ru/vul/2015-09783 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-2980 · Vendor Advisory
• http://seclists.org/oss-sec/2014/q2/152 · Note
• http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/ChangeLog?r1=37756&r2=37755&pathrev=37756 · Note
• http://seclists.org/oss-sec/2014/q2/143 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/92688 · Note
• https://savannah.gnu.org/bugs/?41751 · Note