UBUNTU-CVE-2020-14931: Buffer Overflow
Published Jun 19, 2020
·Updated
A stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) 1.3a might allow remote WHOIS servers to execute arbitrary code via a long line in a response that is mishandled by nicformatbuff.
Affected Software
5 affected components
ubuntu/dmitry*
ubuntu/dmitry*
ubuntu/dmitry*
ubuntu/dmitry*
ubuntu/dmitry*
Event History
Jun 19, 2020
CVE Published
via OSV·10:15 PM
Data Sourced
via OSV·10:15 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which systems are realistically exposed?
Ubuntu systems running DMitry 1.3a are exposed when they query a WHOIS server that can return a maliciously long response line. The affected code path is in DMitry's handling of WHOIS responses.
2
What does an attacker need to exploit this issue?
An attacker needs to provide or control a reachable WHOIS response containing a long line that is mishandled by nic_format_buff. The supplied severity vector indicates network reachability, low attack complexity, and no required privileges or user interaction.