PT-2018-19373 · Pms · Pms

Published 2018-01-01 · Updated 2026-03-28 · CVE-2018-25224

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PMS version 0.42

Description PMS 0.42 contains a stack-based buffer overflow that allows local, unauthenticated attackers to execute arbitrary code by providing malicious values in the configuration file. Attackers can create configuration files with oversized input that overflows the stack buffer and executes shell commands via return-oriented programming gadgets.

Recommendations Update to a newer version of PMS.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2018-25224

Affected Products

Pms

References · 9

• 🔥 https://exploit-db.com/exploits/44426 · Exploit
• https://ubuntu.com/security/CVE-2018-25224 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-25224 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-25224 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-25224 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-25224 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-25224 · Vendor Advisory
• https://vulncheck.com/advisories/pms-stack-based-buffer-overflow-via-configuration-file · Note
• https://pms.sourceforge.net · Note