PT-2020-18700 · Trading Technologies · Trading Technologies Messaging

Published 2020-09-02 · Updated 2020-09-14 · CVE-2020-5779

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Trading Technologies Messaging version 7.1.28.3

Description A flaw in the software relates to invalid parameter handling when calling strcpy s() with an invalid parameter, specifically a long src string parameter, as part of processing a type 4 message sent to the default TCP RequestPort 10200. This issue causes the ttmd.exe process to terminate.

Recommendations For Trading Technologies Messaging version 7.1.28.3, as a temporary workaround, consider restricting access to the default TCP RequestPort 10200 to minimize the risk of exploitation. Avoid sending type 4 messages to this port until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-5779

Affected Products

Trading Technologies Messaging

References · 3

• https://osv.dev/vulnerability/CVE-2020-5779 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5779 · Security Note
• https://tenable.com/security/research/tra-2020-52 · Note