7.5
CVSSv2

CVE-2016-2054

Published: 13/04/2016 Updated: 09/10/2018
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 668
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

Multiple buffer overflows in xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x prior to 4.3.25 allow remote malicious users to execute arbitrary code or cause a denial of service (daemon crash) via a long filename, involving handling a "config" command.

Vulnerable Product Search on Vulmon Subscribe to Product

debian debian linux 8.0

xymon xymon 4.3.3

xymon xymon 4.3.24

xymon xymon 4.3.19

xymon xymon 4.3.18

xymon xymon 4.3.11

xymon xymon 4.3.10

xymon xymon 4.2.3

xymon xymon 4.2.2

xymon xymon 4.1.2

xymon xymon 4.3.8

xymon xymon 4.3.7

xymon xymon 4.3.6

xymon xymon 4.3.21

xymon xymon 4.3.20

xymon xymon 4.3.15

xymon xymon 4.3.14

xymon xymon 4.3.0

xymon xymon 4.2

xymon xymon 4.3.5

xymon xymon 4.3.4

xymon xymon 4.3.2

xymon xymon 4.3.13

xymon xymon 4.3.12

xymon xymon 4.3.9

xymon xymon 4.3.23

xymon xymon 4.3.22

xymon xymon 4.3.17

xymon xymon 4.3.16

xymon xymon 4.3.1

xymon xymon 4.2.0

xymon xymon 4.1.1

xymon xymon 4.1.0

Vendor Advisories

Markus Krell discovered that xymon, a network- and applications-monitoring system, was vulnerable to the following security issues: CVE-2016-2054 The incorrect handling of user-supplied input in the config command can trigger a stack-based buffer overflow, resulting in denial of service (via application crash) or remote code execution CVE-2 ...

Exploits

Xymon 43x versions suffers from buffer overflow, information disclosure, code execution, cross site scripting, and various other vulnerabilities ...