PT-2022-12476 · Giftrans+1 · Giftrans+1

Kolja Grassmann · Published 2022-01-01 · Updated 2023-08-08 · CVE-2021-45972

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions giftrans version 1.12.2

Description The issue arises from a stack-based buffer overflow in the giftrans function. This occurs because a value within the input file dictates the amount of data to be written, allowing an attacker to overwrite up to 250 bytes outside the allocated buffer with arbitrary data.

Recommendations For giftrans version 1.12.2, as a temporary workaround, consider restricting the use of the giftrans function until a patch is available. Avoid using input files that could trigger the buffer overflow. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-1284

Related Identifiers

CVE-2021-45972

Affected Products

Debian

Giftrans

References · 12

• 🔥 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002739 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-45972 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-45972 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-45972 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45972 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-45972 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-45972 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45972 · Vendor Advisory
• https://abdn.ac.uk/tools/ibmpc/giftrans/index.hti · Note
• https://t.me/cibsecurity/34818 · Telegram Post
• https://t.me/cvenotify/25208 · Telegram Post
• http://web.archive.org/web/20150801185019 · Note