PT-2022-12468 · Unknown · Nhi'S Health Insurance Web Service

Yu-Hsiang Lin · Published 2022-06-20 · Updated 2023-06-26 · CVE-2021-45918

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions NHI's health insurance web service component (affected versions not specified)

Description The issue is related to insufficient validation for input string length in the health insurance web service component, which can lead to a heap-based buffer overflow attack. A remote attacker can exploit this to flood the memory space reserved for the program, terminating the service without authentication. This requires a system restart to recover the service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

CWE-1284

Related Identifiers

CVE-2021-45918

Affected Products

Nhi'S Health Insurance Web Service

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-45918 · Security Note
• https://twcert.org.tw/tw/cp-132-6227-eaf49-1.html · Note
• https://t.me/cibsecurity/44813 · Telegram Post