CVE-2018-25225 - Vulnerability Analysis

Overview

SIPP 3.3 contains a buffer overflow caused by oversized values in the configuration file, letting local unauthenticated attackers execute arbitrary code via return-oriented programming gadgets, exploit requires crafted configuration file.

Severity & Score

Impact

Local attackers can execute arbitrary code, potentially gaining full control of the system.

Mitigation

Update to the latest version of SIPP.

References

• http://sipp.sourceforge.net/
• https://www.exploit-db.com/exploits/45288
• https://www.vulncheck.com/advisories/sipp-stack-based-buffer-overflow-via-configuration-file

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner