CVE-2024-25004

CVSS 7.8 HIGHEPSS 1.8%CWE-787

KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insufficient bounds checking and input sanitization (at line 2600). This allows an attacker to overwrite adjacent memory, which leads to arbitrary code execution.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Produtos afetados

n/a · n/a

PoCs públicas encontradas — 3

cve_referencepacketstormsecurity.com/files/177031/KiTTY-0.76.1.13-Command-Injection.htmlnão verificado cve_referencepacketstormsecurity.com/files/177032/KiTTY-0.76.1.13-Buffer-Overflows.htmlnão verificado exploitdbwww.exploit-db.com/exploits/51891não verificado

⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

http://packetstormsecurity.com/files/177031/KiTTY-0.76.1.13-Command-Injection.html http://packetstormsecurity.com/files/177032/KiTTY-0.76.1.13-Buffer-Overflows.html https://blog.defcesco.io/CVE-2024-25003-CVE-2024-25004 http://seclists.org/fulldisclosure/2024/Feb/13 http://seclists.org/fulldisclosure/2024/Feb/14