CVE-2012-4436 Memory corruption in n/a

Medium 4.4 Published 22 Oct 2012 Updated 16 Sep 2024

Local attackers can trigger a buffer overflow in the fwknop client via crafted arguments, causing a crash or potentially executing arbitrary code.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2012-4436?

CVE-2012-4436 is a medium-severity memory corruption vulnerability in n/a, published on 22 Oct 2012. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Buffer overflow in the run_last_args function in client/fwknop.c in fwknop before 2.0.3, when processing --last, might allow local users to cause a denial of service (client crash) and possibly execute arbitrary code via many .fwknop.run arguments.

Weakness: CWE-119

Which versions are affected by CVE-2012-4436?

It affects 1 product.

Products include Cipherdyne Fwknop.

How do I fix CVE-2012-4436?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2012-4436 being exploited?

There is no known exploitation of CVE-2012-4436 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2012-4436, GHSA-f5j9-5h8m-c8mw.