PT-2024-20693 · Kitty · Kitty

Austin A. Defrancesco + 1 · Published 2024-02-09 · Updated 2024-02-14 · CVE-2024-25003

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KiTTY versions 0.76.1.13 and before

Description The issue is a stack-based buffer overflow that occurs via the hostname due to insufficient bounds checking and input sanitization. This allows an attacker to overwrite adjacent memory, leading to arbitrary code execution.

Recommendations For KiTTY versions 0.76.1.13 and before, consider disabling the use of hostnames until a patch is available to prevent exploitation of the stack-based buffer overflow. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2024-25003

Affected Products

Kitty

References · 17

• 🔥 https://blog.defcesco.io/CVE-2024-25003-CVE-2024-25004 · Exploit
• 🔥 https://exploit-db.com/exploits/51890 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2024/Feb/13 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2024/Feb/14 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-25003 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25003 · Vendor Advisory
• https://twitter.com/fletch_ai/status/1757285253402485225 · Twitter Post
• http://packetstormsecurity.com/files/177032/KiTTY-0.76.1.13-Buffer-Overflows.html · Note
• https://t.me/cvenotify/70778 · Telegram Post
• https://twitter.com/Esparta6108713/status/1757875535986712768 · Twitter Post
• https://t.me/pentestingnews/43562 · Telegram Post
• http://packetstormsecurity.com/files/177031/KiTTY-0.76.1.13-Command-Injection.html · Note
• https://t.me/cvenotify/70780 · Telegram Post
• https://twitter.com/buaqbot/status/1757632795440972257 · Twitter Post
• https://t.me/cvenotify/71416 · Telegram Post