PT-2019-15147 · Titania · Nipper-Ng

Mavlevin · Published 2019-10-22 · Updated 2019-11-18 · CVE-2019-17424

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nipper-ng version 0.11.10

Description A stack-based buffer overflow in the processPrivilage() function allows remote attackers to achieve Remote Code Execution or Denial Of Service via a crafted file. This issue is related to the processing of firewall configuration files.

Recommendations For nipper-ng version 0.11.10, consider disabling the processPrivilage() function as a temporary workaround until a patch is available. Restrict access to the IOS/process-general.c module to minimize the risk of exploitation. Avoid using crafted firewall configuration files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-17424

Affected Products

Nipper-Ng

References · 9

• 🔥 https://github.com/guywhataguy/CVE-2019-17424 · Exploit
• 🔥 https://github.com/mavlevin/CVE-2019-17424 · Exploit
• 🔥 https://exploit-db.com/exploits/47673 · Exploit
• 🔥 https://blog.vastart.dev/2019/10/stack-overflow-cve-2019-17424.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-17424 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17424 · Security Note
• https://code.google.com/archive/p/nipper-ng/source/default/source · Note
• https://twitter.com/va_start · Note
• http://packetstormsecurity.com/files/155378/nipper-ng-0.11.10-Remote-Buffer-Overflow.html · Note