CVE-2021-44499: Buffer Overflow
An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can cause a call to $Extract to force an signed integer holding the size of a buffer to take on a large negative number, which is then used as the length of a memcpy call that occurs on the stack, causing a buffer overflow.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-44499?
CVE-2021-44499 is classified as a high-severity vulnerability that can lead to potential exploitation.
How do I fix CVE-2021-44499?
To fix CVE-2021-44499, upgrade FIS GT.M to version 7.0-002 or later, which contains the necessary patches.
What type of attack does CVE-2021-44499 enable?
CVE-2021-44499 enables an attacker to exploit a buffer overflow through crafted input, affecting memory allocation.
Which software versions are affected by CVE-2021-44499?
CVE-2021-44499 affects FIS GT.M versions up to and including 7.0-000.
What component of FIS GT.M is involved in CVE-2021-44499?
CVE-2021-44499 specifically involves the $Extract function and its handling of signed integer buffer sizes.