CVE-2024-25004: Buffer Overflow
KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insufficient bounds checking and input sanitization (at line 2600). This allows an attacker to overwrite adjacent memory, which leads to arbitrary code execution.
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25004?
CVE-2024-25004 is classified as a critical vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2024-25004?
To fix CVE-2024-25004, users should update to KiTTY version 0.76.1.14 or later, which addresses the vulnerability.
What specific issue does CVE-2024-25004 exploit?
CVE-2024-25004 exploits a stack-based buffer overflow caused by insufficient bounds checking in the username input.
What versions of KiTTY are affected by CVE-2024-25004?
KiTTY versions 0.76.1.13 and earlier are affected by CVE-2024-25004.
How can an attacker exploit CVE-2024-25004?
An attacker can exploit CVE-2024-25004 by sending specially crafted input that causes a buffer overflow, potentially allowing code execution.