Stack-based buffer overflow in procps - CVE-2018-1125

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU12993

Stack-based buffer overflow in procps - CVE-2018-1125

Published: May 23, 2018 / Updated: June 17, 2021


Vulnerability identifier: #VU12993
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-1125
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to stack-based buffer overflow. A remote attacker can send a specially crafted request, trigger memory corruption and execute arbitrary code with elevated privileges.


Affected software

procps
Debian Linux
Arch Linux
Slackware Linux
Opensuse
openSUSE Leap
Dynamic System Analysis (DSA) Preboot
Flex System Chassis Management Module (CMM)
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)

How to mitigate CVE-2018-1125

Update to version 3.3.15.

Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65
Flex System Chassis Management Module (CMM) - update to 2pet16d-2.5.13d
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.0.0.5.116
Dell EMC Unity Operating Environment (OE) - update to 5.0.0.0.5.116

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins