Within the function HandleFileArg the argument filepattern is under control of the user who passes it in from the command line. filepattern is passed directly to memcpy copying the path provided by the user into a staticly sized buffer without any length checks resulting in a stack-buffer overflow.
Dentro de la función HandleFileArg el argumento filepattern está bajo el control del usuario que lo pasa desde la línea de comandos. filepattern es pasado directamente a memcpy copiando la ruta proporcionada por el usuario en un búfer de tamaño estático sin ninguna comprobación de longitud, resultando en un desbordamiento del búfer de la pila.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:L/AC:L/Au:N/C:P/I:P/A:P
| Access Vector | LOCAL |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-787
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| att | xmill | 0.7 | <built-in method update of dict object at 0x7e60eb24c340> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:att:xmill:0.7:*:*:*:*:*:*:* |