CVE-2016-20048 - Vulnerability Analysis

Overview

iSelect 1.4.0-2+b1 contains a buffer overflow caused by supplying an oversized value to the -k/--key parameter, letting local attackers execute arbitrary code with user privileges, exploit requires local access.

Severity & Score

Impact

Local attackers can execute arbitrary code with user privileges, potentially compromising the affected system.

Mitigation

Update to the latest version of iSelect.

References

• http://www.ossp.org/pkg/tool/iselect/
• https://www.exploit-db.com/exploits/41076
• https://www.vulncheck.com/advisories/iselect-2-b1-local-buffer-overflow-via-key-parameter

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner