CVE-2016-8661 Memory corruption in Little Snitch version 3.0 through 3.6.1

What is CVE-2016-8661?

CVE-2016-8661 is a high-severity memory corruption vulnerability in Little Snitch version 3.0 through 3.6.1, published on 15 Nov 2016. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Little Snitch version 3.0 through 3.6.1 suffer from a buffer overflow vulnerability that could be locally exploited which could lead to an escalation of privileges (EoP) and unauthorised ring0 access to the operating system. The buffer overflow is related to insufficient checking of parameters to the "OSMalloc" and "copyin" kernel API calls.

Weakness: CWE-119

Which versions are affected by CVE-2016-8661?

It affects 1 product.

Products include Obdev Little Snitch.

How do I fix CVE-2016-8661?

No fix has been published for CVE-2016-8661 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2016-8661 being exploited?

There is no known exploitation of CVE-2016-8661 in the wild and no public exploit code.

Other vulnerabilities in Little Snitch version 3.0 through 3.6.1

• CVE-2020-13095 Privilege escalation in Little Snitch High 8.8
• CVE-2017-2675 Privilege escalation in Little Snitch High 7.8
• CVE-2019-13013 Privilege escalation in Little Snitch Medium 5.5
• CVE-2019-13014 Little Snitch versions 4.4.0 fixes a vulnerability in a privileged helper tool. Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pj5v-hc9m-mp8j.