CVE-2017-8192
published 2017-11-22CVE-2017-8192: FusionSphere OpenStack V100R006C00 has an improper authorization vulnerability. Due to improper authorization, an attacker with low privilege may exploit this…
PriorityP336high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
EPSS
0.22%
12.0th percentile
FusionSphere OpenStack V100R006C00 has an improper authorization vulnerability. Due to improper authorization, an attacker with low privilege may exploit this vulnerability to obtain the operation authority of some specific directory, causing privilege escalation.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| huawei | fusionsphere_openstack | — | — |
| huawei_technologies_co_ltd | fusionsphere_openstack | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hjqc-wrmr-hq47: FusionSphere OpenStack V100R006C00 has an improper authorization vulnerability
ghsa_unreviewed·2022-05-13
CVE-2017-8192 [HIGH] CWE-863 GHSA-hjqc-wrmr-hq47: FusionSphere OpenStack V100R006C00 has an improper authorization vulnerability
FusionSphere OpenStack V100R006C00 has an improper authorization vulnerability. Due to improper authorization, an attacker with low privilege may exploit this vulnerability to obtain the operation authority of some specific directory, causing privilege escalation.
Red Hat
wget: Heap-based buffer overflow in HTTP protocol handling
vendor_redhat·2017-10-26·CVSS 8.8
CVE-2017-13090 [HIGH] CWE-122 wget: Heap-based buffer overflow in HTTP protocol handling
wget: Heap-based buffer overflow in HTTP protocol handling
The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to read the chunk in pieces of 8192 bytes by using the MIN() macro, but ends up passing the negative chunk length to retr.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. The attacker can corrupt malloc metadata after the allocated buffer.
A heap-based buffer overflow, when processing chunked encoded HTTP responses, was found in wget.
No detection rules found.
No public exploits indexed.
HackerOne
CVE-2017-13090 wget heap smash
hackerone·2019-11-12·CVSS 8.8
CVE-2017-13090 [HIGH] CVE-2017-13090 wget heap smash
CVE-2017-13090 wget heap smash
The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to read the chunk in pieces of 8192 bytes by using the MIN() macro, but ends up passing the negative chunk length to retr.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. The attacker can corrupt malloc metadata after the allocated buffer.
Reproduction
To reproduce, use two terminals. In the first terminal:
$ nc -l -p 8080 <wget-heap-smash.reply
In the second te
Bugzilla
CVE-2017-13090 wget: Heap-based buffer overflow in HTTP protocol handling
bugzilla·2017-10-23·CVSS 8.8
CVE-2017-13090 [HIGH] CVE-2017-13090 wget: Heap-based buffer overflow in HTTP protocol handling
CVE-2017-13090 wget: Heap-based buffer overflow in HTTP protocol handling
A heap-based buffer overflow vulnerability was found in HTTP protocol handling, potentially allowing a code execution.
The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to read the chunk in pieces of 8192 bytes by using the MIN() macro, but ends up passing the negative chunk length to retr.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. The attacker can corrupt malloc metadata after the al
2017-11-22
Published