ZDI-CAN-21015: ZDI-23-1858: oFono SMS Decoder Stack-based Buffer Overflow Remote Code Execution Vulnerability
Published Dec 20, 2023
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of oFono. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2023-4234.
Affected Software
1 affected component
oFono oFono
Event History
Dec 20, 2023
Advisory Published
06:00 AM
Data Sourced
06:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-CAN-21015?
ZDI-CAN-21015 is assigned a high CVSS rating due to its potential for remote code execution without authentication.
2
How do I fix ZDI-CAN-21015?
To mitigate ZDI-CAN-21015, update to the latest version of oFono that includes patches for this vulnerability.
3
What software is affected by ZDI-CAN-21015?
ZDI-CAN-21015 affects installations of the oFono software.
4
Can ZDI-CAN-21015 be exploited remotely?
Yes, ZDI-CAN-21015 can be exploited remotely by attackers without requiring authentication.
5
What type of vulnerability is ZDI-CAN-21015?
ZDI-CAN-21015 is a stack-based buffer overflow vulnerability that allows for remote code execution.