#VU33089 Input validation error - CVE-2014-0477

Vulnerability identifier: #VU33089

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2014-0477

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Description

The vulnerability allows remote attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (CPU consumption) via an empty quoted string in an RFC 2822 address.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

External links
https://seclists.org/oss-sec/2014/q2/563
https://secunia.com/advisories/59212
https://secunia.com/advisories/59333
https://secunia.com/advisories/61981
https://www.debian.org/security/2014/dsa-2969
https://bugzilla.redhat.com/show_bug.cgi?id=1110723
https://github.com/rjbs/Email-Address/blob/master/Changes
https://github.com/rjbs/Email-Address/commit/83f8306117115729ac9346523762c0c396251eb5
https://metacpan.org/release/RJBS/Email-Address-1.905

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.