CVE-2020-7881 AfreecaTV streamer service stack-based buffer overflow
A stack-based buffer overflow in the AfreecaTV streamer service allows remote attackers to execute arbitrary code via a crafted FanTicket field.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-7881?
CVE-2020-7881 is a high-severity memory corruption vulnerability in afreecatvstreamer.exe, published on 26 Nov 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The vulnerability function is enabled when the streamer service related to the AfreecaTV communicated through web socket using 21201 port. A stack-based buffer overflow leading to remote code execution was discovered in strcpy() operate by "FanTicket" field. It is because of stored data without validation of length.
Which versions are affected by CVE-2020-7881?
It affects 1 product.
Products include Afreecatv Afreecatv.
How do I fix CVE-2020-7881?
No fix has been published for CVE-2020-7881 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-7881 being exploited?
There is no known exploitation of CVE-2020-7881 in the wild and no public exploit code.
Sources
Also known as GHSA-22qh-5xm8-3xfw.