Vulnerability Details : CVE-2020-5208
It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. This problem is fixed in version 1.8.19.
Vulnerability category: OverflowExecute code
Products affected by CVE-2020-5208
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
- cpe:2.3:a:ipmitool_project:ipmitool:1.8.18:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-5208
0.84%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 80 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-5208
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST | |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST | |
|
7.7
|
HIGH | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N |
1.3
|
5.8
|
GitHub, Inc. |
CWE ids for CVE-2020-5208
-
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.Assigned by:
- nvd@nist.gov (Secondary)
- security-advisories@github.com (Primary)
References for CVE-2020-5208
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K2BPW66KDP4H36AGZXLED57A3O2Y6EQW/
[SECURITY] Fedora 31 Update: ipmitool-1.8.18-19.fc31 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2021/06/msg00029.html
[SECURITY] [DLA 2699-1] ipmitool security updateMailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RYYEKUAUTCWICM77HOEGZDVVEUJLP4BP/
[SECURITY] Fedora 30 Update: ipmitool-1.8.18-19.fc30 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00031.html
[security-announce] openSUSE-SU-2020:0247-1: important: Security updateMailing List;Third Party Advisory
-
https://github.com/ipmitool/ipmitool/commit/e824c23316ae50beb7f7488f2055ac65e8b341f2
fru: Fix buffer overflow vulnerabilities · ipmitool/ipmitool@e824c23 · GitHubPatch;Third Party Advisory
-
https://security.gentoo.org/glsa/202101-03
ipmitool: Multiple vulnerabilities (GLSA 202101-03) — Gentoo securityThird Party Advisory
-
https://lists.debian.org/debian-lts-announce/2020/02/msg00006.html
[SECURITY] [DLA 2098-1] ipmitool security updateMailing List;Third Party Advisory
-
https://github.com/ipmitool/ipmitool/security/advisories/GHSA-g659-9qxw-p7cp
Multiple potential remote code execution vulnerabilities · Advisory · ipmitool/ipmitool · GitHubPatch;Third Party Advisory
Jump to