PT-2024-14444 · Grossd+2 · Grossd+2

Bizdelnick · Published 2024-03-17 · Updated 2025-03-20 · CVE-2023-52159

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions gross versions 0.9.3 through 1.x before 1.0.4

Description A stack-based buffer overflow vulnerability allows remote attackers to trigger a denial of service (grossd daemon crash) or potentially execute arbitrary code in grossd via crafted SMTP transaction parameters that cause an incorrect strncat for a log entry.

Recommendations For versions 0.9.3 through 1.x before 1.0.4, update to version 1.0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the grossd daemon to minimize the risk of exploitation. Avoid using crafted SMTP transaction parameters that could cause an incorrect strncat for a log entry until the issue is resolved.

Fix

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2023-52159

DLA-3774-1

USN-6942-1

Affected Products

Linuxmint

Ubuntu

Grossd

References · 20

• https://osv.dev/vulnerability/UBUNTU-CVE-2023-52159 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52159 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3774-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6942-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-52159 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-52159 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-52159 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6942-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-52159 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-52159 · Security Note
• https://codeberg.org/bizdelnick/gross/wiki/Known-vulnerabilities#cve-2023-52159 · Note
• https://t.me/cvenotify/115574 · Telegram Post
• https://lists.debian.org/debian-lts-announce/2024/03/msg00027.html · Note
• https://twitter.com/VulmonFeeds/status/1769600406743601296 · Twitter Post
• https://t.me/cvenotify/74106 · Telegram Post