PT-2024-20694 · Kitty · Kitty

Austin A. Defrancesco + 1 · Published 2024-02-09 · Updated 2024-02-14 · CVE-2024-25004

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KiTTY versions 0.76.1.13 and before

Description The issue is a stack-based buffer overflow that occurs due to insufficient bounds checking and input sanitization via the username. This allows an attacker to overwrite adjacent memory, leading to arbitrary code execution. The vulnerability is located at line 2600.

Recommendations For KiTTY versions 0.76.1.13 and before, as a temporary workaround, consider restricting the input for the username variable to prevent exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2024-25004

Affected Products

Kitty

References · 16

• 🔥 https://blog.defcesco.io/CVE-2024-25003-CVE-2024-25004 · Exploit
• 🔥 https://exploit-db.com/exploits/51891 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2024/Feb/13 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2024/Feb/14 · Exploit
• https://osv.dev/vulnerability/CVE-2024-25004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25004 · Security Note
• https://t.me/cvenotify/70781 · Telegram Post
• https://twitter.com/fletch_ai/status/1757285253402485225 · Twitter Post
• http://packetstormsecurity.com/files/177032/KiTTY-0.76.1.13-Buffer-Overflows.html · Note
• https://twitter.com/Esparta6108713/status/1757875535986712768 · Twitter Post
• https://t.me/pentestingnews/43562 · Telegram Post
• http://packetstormsecurity.com/files/177031/KiTTY-0.76.1.13-Command-Injection.html · Note
• https://twitter.com/buaqbot/status/1757632795440972257 · Twitter Post
• https://t.me/cvenotify/70779 · Telegram Post
• https://twitter.com/CVEnew/status/1755855058720412036 · Twitter Post