ZDI-CAN-21014: ZDI-23-1860: oFono SMS Decoder Stack-based Buffer Overflow Remote Code Execution Vulnerability

Published Dec 20, 2023

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of oFono. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2023-4232.

Affected Software

1 affected component

oFono oFono

Event History

Dec 20, 2023

Advisory Published

06:00 AM

Data Sourced

06:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-21014?

ZDI-CAN-21014 has a high severity due to its potential for remote code execution without authentication.

How do I fix ZDI-CAN-21014?

To mitigate ZDI-CAN-21014, update to the latest version of oFono that addresses this vulnerability.

What types of attacks can exploit ZDI-CAN-21014?

ZDI-CAN-21014 can be exploited by remote attackers to execute arbitrary code on affected installations of oFono.

Is authentication required to exploit ZDI-CAN-21014?

No, authentication is not required to exploit ZDI-CAN-21014, making it particularly dangerous.

Which software is affected by ZDI-CAN-21014?

ZDI-CAN-21014 affects installations of oFono, specifically versions that have not been updated to address the vulnerability.