CVE-2024-25004: Buffer Overflow
First published: Fri Feb 09 2024(Updated: )
KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insufficient bounds checking and input sanitization (at line 2600). This allows an attacker to overwrite adjacent memory, which leads to arbitrary code execution.
Credit: cve@mitre.org DEFCESCO
| Affected Software | Affected Version | How to fix |
|---|---|---|
| 9bis KiTTY | <=0.76.1.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/177031/KiTTY-0.76.1.13-Command-Injection.html
- http://packetstormsecurity.com/files/177032/KiTTY-0.76.1.13-Buffer-Overflows.html
- http://seclists.org/fulldisclosure/2024/Feb/13
- http://seclists.org/fulldisclosure/2024/Feb/14
- https://blog.defcesco.io/CVE-2024-25003-CVE-2024-25004
- https://www.exploit-db.com/exploits/51891
Frequently Asked Questions
What is the severity of CVE-2024-25004?
CVE-2024-25004 is classified as a critical vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2024-25004?
To fix CVE-2024-25004, users should update to KiTTY version 0.76.1.14 or later, which addresses the vulnerability.
What specific issue does CVE-2024-25004 exploit?
CVE-2024-25004 exploits a stack-based buffer overflow caused by insufficient bounds checking in the username input.
What versions of KiTTY are affected by CVE-2024-25004?
KiTTY versions 0.76.1.13 and earlier are affected by CVE-2024-25004.
How can an attacker exploit CVE-2024-25004?
An attacker can exploit CVE-2024-25004 by sending specially crafted input that causes a buffer overflow, potentially allowing code execution.
- agent/type
- agent/first-publish-date
- agent/description
- agent/weakness
- agent/severity
- agent/softwarecombine
- exploited/true
- collector/exploitdb-recent
- source/ExploitDB
- alias/CVE-2024-25004
- agent/author
- agent/references
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/9bis
- canonical/9bis kitty
- version/9bis kitty/0.76.1.13