Integer overflow in gSOAP - CVE-2021-21783

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU51718

Integer overflow in gSOAP - CVE-2021-21783

Published: March 25, 2021


Vulnerability identifier: #VU51718
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-21783
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the WS-Addressing plugin functionality. A remote attacker can send a specially crafted SOAP request, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

gSOAP
Oracle Communications User Data Repository
Oracle Communications EAGLE Application Processor

How to mitigate CVE-2021-21783

Install updates from vendor's website.

gSOAP - update to 2.8.111

External References

Related Security Bulletins