Paper/Archive/CVE-2020-12651

CVE-2020-12651

mitre — SecureCRT before 8.7.2 allows remote attackers to execute arbitrary code via an Integer Overflow and a Buffer Overflow because a banner c…

EPSS 7%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 93.8.938 × 2018.8 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

SecureCRT before 8.7.2 allows remote attackers to execute arbitrary code via an Integer Overflow and a Buffer Overflow because a banner can trigger a line number to CSI functions that exceeds INT_MAX.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refvandyke.com/support/advisory/index.html reftwitter.com/taviso/status/1261079774190919680 refbugs.chromium.org/p/project-zero/issues/detail?id=2033 refvandyke.com/products/securecrt/history.txt