Tiny SRP CVE-2015-4675 Remote Buffer Overflow Vulnerability

Bugtraq ID:	75365
Class:	Boundary Condition Error
CVE:	CVE-2015-4675
Remote:	Yes
Local:	No
Published:	Jun 22 2015 12:00AM
Updated:	Jun 22 2015 12:00AM
Credit:	Douglas Held
Vulnerable:	TinySRP Project Tiny SRP 0.7.5
Not Vulnerable:

Tiny SRP CVE-2015-4675 Remote Buffer Overflow Vulnerability

Tiny SRP is prone to a remote buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed exploit attempts may result in a denial-of-service condition.

Tiny SRP CVE-2015-4675 Remote Buffer Overflow Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Tiny SRP CVE-2015-4675 Remote Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Tiny SRP CVE-2015-4675 Remote Buffer Overflow Vulnerability

References:

• Fwd: Potentially critical buffer overflow in TinySRP (Douglas Held)
  
• Tiny SRP Homepage (Tiny SRP)