PT-2023-10267 · Ayttm · Ayttm

Kapil A · Published 2023-03-05 · Updated 2024-05-17 · CVE-2015-10088

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ayttm versions up to 0.5.0.89

Description A critical vulnerability was found in ayttm, affecting the function http connect in the library libproxy/proxy.c. The manipulation leads to a format string issue, which can be initiated remotely. The complexity of an attack is rather high, and the exploitability is difficult.

Recommendations To fix this issue, it is recommended to apply a patch named 40e04680018614a7d2b68566b261b061a0597046 for versions up to 0.5.0.89. As a temporary workaround, consider disabling the http connect function in the libproxy/proxy.c library until a patch is available.

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2015-10088

Affected Products

Ayttm

References · 10

• https://github.com/ayttm/ayttm/commit/40e04680018614a7d2b68566b261b061a0597046 · Patch
• https://cve.org/CVERecord?id=CVE-2015-10088 · Security Note
• https://ubuntu.com/security/CVE-2015-10088 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-10088 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-10088 · Security Note
• https://vuldb.com/?id.222267 · Note
• https://t.me/cvenotify/45535 · Telegram Post
• https://t.me/cibsecurity/59426 · Telegram Post
• https://vuldb.com/?ctiid.222267 · Note
• https://sourceforge.net/p/ayttm/mailman/message/34397158 · Note