ZDI-CAN-20996: ZDI-23-1859: oFono SMS Decoder Stack-based Buffer Overflow Remote Code Execution Vulnerability

Published Dec 20, 2023

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of oFono. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2023-4233.

Affected Software

1 affected component

oFono oFono

Event History

Dec 20, 2023

Advisory Published

06:00 AM

Data Sourced

06:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-20996?

ZDI-CAN-20996 is rated with a high severity due to its potential for remote code execution without authentication.

How do I fix ZDI-CAN-20996?

To fix ZDI-CAN-20996, update to the latest version of oFono that includes the security patch for this vulnerability.

What are the consequences of exploiting ZDI-CAN-20996?

Exploiting ZDI-CAN-20996 allows attackers to execute arbitrary code on affected systems, leading to potential full system compromise.

Who is affected by ZDI-CAN-20996?

Users of affected versions of oFono are at risk from ZDI-CAN-20996 and should take immediate action to secure their systems.

Is authentication required to exploit ZDI-CAN-20996?

No, authentication is not required to exploit ZDI-CAN-20996, making it particularly dangerous.