PT-2021-12701 · Afreecatv · Afreecatv

Published 2021-11-26 · Updated 2022-07-08 · CVE-2020-7881

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: AfreecaTV (affected versions not specified)

Description: A stack-based buffer overflow leading to remote code execution was discovered in the strcpy() function operated by the FanTicket field. This issue arises due to stored data without validation of length. The vulnerability is enabled when the streamer service related to AfreecaTV communicates through a web socket using the 21201 port.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Memory Corruption

Weakness Enumeration

CWE-190

CWE-787

Related Identifiers

CVE-2020-7881

Affected Products

Afreecatv

References · 4

• https://osv.dev/vulnerability/CVE-2020-7881 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7881 · Security Note
• https://t.me/cibsecurity/33002 · Telegram Post
• https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36357 · Note