PT-2019-15175 · Hydra · Hydra

Felix Blanco + 2 · Published 2019-10-12 · Updated 2019-10-17 · CVE-2019-17502

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Hydra versions prior to 0.1.9

Description The issue arises from a NULL pointer dereference and daemon crash when processing POST requests that lack a Content-Length header. This is attributed to the process header end() function, which calls boa atoi(), ultimately leading to atoi() being called on a NULL pointer. The files read.c, request.c, and util.c are involved in this process.

Recommendations For Hydra versions prior to 0.1.9, consider updating to a version that includes a fix for this issue to prevent daemon crashes when handling specific POST requests. As a temporary workaround, consider restricting access to the process header end() function or ensuring that all POST requests include a valid Content-Length header until a patch is available.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2019-17502

Affected Products

Hydra

References · 4

• 🔥 https://gist.github.com/fxb6476/0b9883a88ff2ca40de46a8469834e16c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-17502 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17502 · Vendor Advisory
• http://hydra.hellug.gr · Note