CVE-2024-25724: Buffer Overflow
In RTI Connext Professional 5.3.1 through 6.1.0 before 6.1.1, a buffer overflow in XML parsing from Routing Service, Recording Service, Queuing Service, and Cloud Discovery Service allows attackers to execute code with the affected service's privileges, compromise the service's integrity, leak sensitive information, or crash the service. These attacks could be done via a remote malicious RTPS message; a compromised call with malicious parameters to the RTIRoutingServicenew, rti::recording::Service, RTIQueuingServicenew, or RTICDSServicenew public APIs; or a compromised local file system containing a malicious XML file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25724?
CVE-2024-25724 has a high severity rating due to the potential for remote code execution and privilege escalation.
How do I fix CVE-2024-25724?
To fix CVE-2024-25724, update RTI Connext Professional to version 6.1.1 or later.
What services are affected by CVE-2024-25724?
CVE-2024-25724 affects the Routing Service, Recording Service, Queuing Service, and Cloud Discovery Service in RTI Connext Professional.
Can CVE-2024-25724 lead to data leakage?
Yes, CVE-2024-25724 can lead to sensitive data leakage due to its buffer overflow vulnerability.
What types of attack can be executed through CVE-2024-25724?
CVE-2024-25724 allows attackers to execute arbitrary code with the affected service's privileges, which can compromise the service's integrity.