CVE-2015-10088

ayttm proxy.c http_connect format string

Published Mar 5, 2023 CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Description

A vulnerability, which was classified as critical, was found in ayttm up to 0.5.0.89. This affects the function http_connect in the library libproxy/proxy.c. The manipulation leads to format string. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The patch is named 40e04680018614a7d2b68566b261b061a0597046. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-222267.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

ayttm

affected

Version	Status	Constraints
`0.5.0.0`	affected	—
`0.5.0.1`	affected	—
`0.5.0.2`	affected	—
`0.5.0.3`	affected	—
`0.5.0.4`	affected	—
`0.5.0.5`	affected	—
`0.5.0.6`	affected	—
`0.5.0.7`	affected	—
`0.5.0.8`	affected	—
`0.5.0.9`	affected	—
`0.5.0.10`	affected	—
`0.5.0.11`	affected	—
`0.5.0.12`	affected	—
`0.5.0.13`	affected	—
`0.5.0.14`	affected	—
`0.5.0.15`	affected	—
`0.5.0.16`	affected	—
`0.5.0.17`	affected	—
`0.5.0.18`	affected	—
`0.5.0.19`	affected	—
`0.5.0.20`	affected	—
`0.5.0.21`	affected	—
`0.5.0.22`	affected	—
`0.5.0.23`	affected	—
`0.5.0.24`	affected	—
`0.5.0.25`	affected	—
`0.5.0.26`	affected	—
`0.5.0.27`	affected	—
`0.5.0.28`	affected	—
`0.5.0.29`	affected	—
`0.5.0.30`	affected	—
`0.5.0.31`	affected	—
`0.5.0.32`	affected	—
`0.5.0.33`	affected	—
`0.5.0.34`	affected	—
`0.5.0.35`	affected	—
`0.5.0.36`	affected	—
`0.5.0.37`	affected	—
`0.5.0.38`	affected	—
`0.5.0.39`	affected	—
`0.5.0.40`	affected	—
`0.5.0.41`	affected	—
`0.5.0.42`	affected	—
`0.5.0.43`	affected	—
`0.5.0.44`	affected	—
`0.5.0.45`	affected	—
`0.5.0.46`	affected	—
`0.5.0.47`	affected	—
`0.5.0.48`	affected	—
`0.5.0.49`	affected	—
`0.5.0.50`	affected	—
`0.5.0.51`	affected	—
`0.5.0.52`	affected	—
`0.5.0.53`	affected	—
`0.5.0.54`	affected	—
`0.5.0.55`	affected	—
`0.5.0.56`	affected	—
`0.5.0.57`	affected	—
`0.5.0.58`	affected	—
`0.5.0.59`	affected	—
`0.5.0.60`	affected	—
`0.5.0.61`	affected	—
`0.5.0.62`	affected	—
`0.5.0.63`	affected	—
`0.5.0.64`	affected	—
`0.5.0.65`	affected	—
`0.5.0.66`	affected	—
`0.5.0.67`	affected	—
`0.5.0.68`	affected	—
`0.5.0.69`	affected	—
`0.5.0.70`	affected	—
`0.5.0.71`	affected	—
`0.5.0.72`	affected	—
`0.5.0.73`	affected	—
`0.5.0.74`	affected	—
`0.5.0.75`	affected	—
`0.5.0.76`	affected	—
`0.5.0.77`	affected	—
`0.5.0.78`	affected	—
`0.5.0.79`	affected	—
`0.5.0.80`	affected	—
`0.5.0.81`	affected	—
`0.5.0.82`	affected	—
`0.5.0.83`	affected	—
`0.5.0.84`	affected	—
`0.5.0.85`	affected	—
`0.5.0.86`	affected	—
`0.5.0.87`	affected	—
`0.5.0.88`	affected	—
`0.5.0.89`	affected	—

Configuration 1 [-]

cpe:2.3:a:ayttm_project:ayttm:*:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2015-1098	A vulnerability, which was classified as critical, was found in ayttm up to 0.5.0.89. This affects the function http_connect in the library libproxy/proxy.c. The manipulation leads to format string. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The patch is named 40e04680018614a7d2b68566b261b061a0597046. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-222267.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity High

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.721% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/ayttm/ayttm/commit/40e04680018614a7d2b68566b261b061a0597046
https://sourceforge.net/p/ayttm/mailman/message/34397158/
https://vuldb.com/?ctiid.222267
https://vuldb.com/?id.222267