CVE-2018-5704
Open On-Chip Debugger (OpenOCD) 0.10.0 does not block attempts to use ...
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Ubuntu (orta).
Açıklama
Open On-Chip Debugger (OpenOCD) 0.10.0 does not block attempts to use HTTP POST for sending data to 127.0.0.1 port 4444, which allows remote attackers to conduct cross-protocol scripting attacks, and consequently execute arbitrary commands, via a crafted web site.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| debian 11 | openocd | 0.10.0-4 |
| debian 12 | openocd | 0.10.0-4 |
| debian 13 | openocd | 0.10.0-4 |
| debian 14 | openocd | 0.10.0-4 |
| debian 7 | openocd | 0.5.0-1+deb7u1 |
| debian 8 | openocd | 0.8.0-4+deb7u1 |
| debian 9 | openocd | 0.9.0-1+deb8u1 |
| echo | openocd | 0.10.0-4 |
| ubuntu 16.04 | openocd | 0.9.0-1+deb8u1build0.16.04.1 |
| ubuntu 16.04-ESM | openocd | 0.9.0-1+deb8u1build0.16.04.1 |
Referanslar
- http://openocd.zylin.com/4330
- http://openocd.zylin.com/4331
- http://openocd.zylin.com/4335
- https://lists.debian.org/debian-lts-announce/2018/01/msg00027.html
- https://sourceforge.net/p/openocd/mailman/message/36188041/
- https://www.cve.org/CVERecord?id=CVE-2018-5704
- https://www.debian.org/security/2018/dsa-4093