Sign-up

ID

VAR-201808-0677


CVE

CVE-2018-10932


TITLE

lldptool Buffer error vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-009348

DESCRIPTION

lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an attacker to inject shell control characters into the buffer and impact the behavior of the terminal. lldptool Contains a buffer error vulnerability.Information may be tampered with. lldptool is an implementation of the Link Layer Discovery Protocol. There is a security vulnerability in lldptool 1.0.1 and earlier versions. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Low: lldpad security and bug fix update Advisory ID: RHSA-2019:3673-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2019:3673 Issue date: 2019-11-05 CVE Names: CVE-2018-10932 ===================================================================== 1. Summary: An update for lldpad is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: The lldpad packages provide the Linux user space daemon and configuration tool for Intel's Link Layer Discovery Protocol (LLDP) Agent with Enhanced Ethernet support. Security Fix(es): * lldptool: improper sanitization of shell-escape codes (CVE-2018-10932) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1614896 - CVE-2018-10932 lldptool: improper sanitization of shell-escape codes 1727326 - lldpad memory usage increases over time 6. Package List: Red Hat Enterprise Linux BaseOS (v. 8): Source: lldpad-1.0.1-13.git036e314.el8.src.rpm aarch64: lldpad-1.0.1-13.git036e314.el8.aarch64.rpm lldpad-debuginfo-1.0.1-13.git036e314.el8.aarch64.rpm lldpad-debugsource-1.0.1-13.git036e314.el8.aarch64.rpm ppc64le: lldpad-1.0.1-13.git036e314.el8.ppc64le.rpm lldpad-debuginfo-1.0.1-13.git036e314.el8.ppc64le.rpm lldpad-debugsource-1.0.1-13.git036e314.el8.ppc64le.rpm s390x: lldpad-1.0.1-13.git036e314.el8.s390x.rpm lldpad-debuginfo-1.0.1-13.git036e314.el8.s390x.rpm lldpad-debugsource-1.0.1-13.git036e314.el8.s390x.rpm x86_64: lldpad-1.0.1-13.git036e314.el8.i686.rpm lldpad-1.0.1-13.git036e314.el8.x86_64.rpm lldpad-debuginfo-1.0.1-13.git036e314.el8.i686.rpm lldpad-debuginfo-1.0.1-13.git036e314.el8.x86_64.rpm lldpad-debugsource-1.0.1-13.git036e314.el8.i686.rpm lldpad-debugsource-1.0.1-13.git036e314.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-10932 https://access.redhat.com/security/updates/classification/#low https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXcHqL9zjgjWX9erEAQg8uxAAp1sXX7k616voF4T1ESaLw/2xgwVpXcFA rssf0zsmwNH4Ckt/ehyTMTyeE2b0pEZajfQDLfP5u6Baz6YHJr3/gnDG8/ffHJZ5 alvJGBoWPTtgVvcmC/T8++eUyMQ9KmpG1SX6sUiIvTbxNVGAe8eYEWmEv3cOVNo9 fClotoOCiOc+T18xqHfBiUybFuqYYnApzb/UH5R0LEY5hND76PKaijrnNhw+vLe8 KOnfFu3h79IAfAFbSfj62LTKLNnScHtzNB5N0dlmt/UzyTX0yRZLD4ISqq4j6a7H svOTOb7w2PefY+pIN/nwooR2rcD9w98N7KmH2q+8euzE2x9BeuoEgBLe7hH40dSo P8siGfzIGhnw1xNdF/8VgUlow0HFRfNXycxVYtTJCwcPczrUFJr0NeaQ9ATwdToI N14/JjJ/dpLGoTboUAub2Nhgx3Y4PJEKqnNHfA0hC/0YJ6VHHtbXAmKFiHmZGiNz LwAUMQYQ4BcOU0eIy1y55rDy4drAmf1QI+QXq7A0Ax8e8uCxAVcjkoeYbS1ecl1V fbC9wtM5Ev/OMWt1nEJfsScDeqIUZKpOYk2nYPVB2EoDzyzlPKJKiv8T1Eu9brY3 WcffJxHFd2JhPvrxEj9YfCZK4Zk7UEN0swQMEURknKgbSEyaU79mnU6Qlk8DNSJ4 KxLsAQumMR8= =tsSa -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 1.89

sources: NVD: CVE-2018-10932 // JVNDB: JVNDB-2018-009348 // VULHUB: VHN-120741 // VULMON: CVE-2018-10932 // PACKETSTORM: 155134

AFFECTED PRODUCTS

vendor:intelmodel:lldptoolscope:lteversion:1.0.1

Trust: 1.8

vendor:intelmodel:lldptoolscope:eqversion:1.0.1

Trust: 0.6

sources: JVNDB: JVNDB-2018-009348 // CNNVD: CNNVD-201808-644 // NVD: CVE-2018-10932

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-10932
value: MEDIUM

Trust: 1.0

secalert@redhat.com: CVE-2018-10932
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-10932
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201808-644
value: MEDIUM

Trust: 0.6

VULHUB: VHN-120741
value: LOW

Trust: 0.1

VULMON: CVE-2018-10932
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2018-10932
severity: LOW
baseScore: 3.3
vectorString: AV:A/AC:L/AU:N/C:N/I:P/A:N
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.5
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-120741
severity: LOW
baseScore: 3.3
vectorString: AV:A/AC:L/AU:N/C:N/I:P/A:N
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.5
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-10932
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 1.4
version: 3.0

Trust: 2.8

sources: VULHUB: VHN-120741 // VULMON: CVE-2018-10932 // JVNDB: JVNDB-2018-009348 // CNNVD: CNNVD-201808-644 // NVD: CVE-2018-10932 // NVD: CVE-2018-10932

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

problemtype:CWE-117

Trust: 1.1

sources: VULHUB: VHN-120741 // JVNDB: JVNDB-2018-009348 // NVD: CVE-2018-10932

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-201808-644

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201808-644

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-009348

PATCH
title:OID Printing changes #7url:https://github.com/intel/openlldp/pull/7
Trust: 0.8
title:lldptool Security vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=84230
Trust: 0.6
title:Red Hat: Low: lldpad security and bug fix updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20193673 - Security Advisory
Trust: 0.1
title:Debian CVElist Bug Report Logs: lldpad: CVE-2018-10932: improper sanitization of shell-escape codesurl:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=c0ceb81422c83f815ced17a890b82af1
Trust: 0.1
title:Red Hat: CVE-2018-10932url:https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database&qid=CVE-2018-10932
Trust: 0.1
sources:
            
            
            VULMON: CVE-2018-10932 // 
            
            
            
            JVNDB: JVNDB-2018-009348 // 
            
            
            
            CNNVD: CNNVD-201808-644

EXTERNAL IDS
db:NVDid:CVE-2018-10932
Trust: 2.7
db:PACKETSTORMid:155134
Trust: 0.8
db:JVNDBid:JVNDB-2018-009348
Trust: 0.8
db:CNNVDid:CNNVD-201808-644
Trust: 0.7
db:AUSCERTid:ESB-2019.4153
Trust: 0.6
db:AUSCERTid:ESB-2021.3593
Trust: 0.6
db:VULHUBid:VHN-120741
Trust: 0.1
db:VULMONid:CVE-2018-10932
Trust: 0.1
sources:
            
            
            VULHUB: VHN-120741 // 
            
            
            
            VULMON: CVE-2018-10932 // 
            
            
            
            JVNDB: JVNDB-2018-009348 // 
            
            
            
            PACKETSTORM: 155134 // 
            
            
            
            CNNVD: CNNVD-201808-644 // 
            
            
            
            NVD: CVE-2018-10932

REFERENCES
url:https://access.redhat.com/errata/rhsa-2019:3673
Trust: 2.6
url:https://bugzilla.redhat.com/show_bug.cgi?id=1551623
Trust: 1.8
url:https://bugzilla.redhat.com/show_bug.cgi?id=cve-2018-10932
Trust: 1.8
url:https://github.com/intel/openlldp/pull/7
Trust: 1.8
url:https://access.redhat.com/security/cve/cve-2018-10932
Trust: 1.4
url:https://nvd.nist.gov/vuln/detail/cve-2018-10932
Trust: 0.9
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/148721
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-10932
Trust: 0.8
url:https://access.redhat.com/errata/rhba-2019:2339
Trust: 0.6
url:https://bugzilla.redhat.com/show_bug.cgi?id=1614896
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2021.3593
Trust: 0.6
url:https://packetstormsecurity.com/files/155134/red-hat-security-advisory-2019-3673-01.html
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.4153/
Trust: 0.6
url:https://cwe.mitre.org/data/definitions/119.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://www.redhat.com/mailman/listinfo/rhsa-announce
Trust: 0.1
url:https://access.redhat.com/security/updates/classification/#low
Trust: 0.1
url:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/
Trust: 0.1
url:https://bugzilla.redhat.com/):
Trust: 0.1
url:https://access.redhat.com/security/team/key/
Trust: 0.1
url:https://access.redhat.com/articles/11258
Trust: 0.1
url:https://access.redhat.com/security/team/contact/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-120741 // 
            
            
            
            VULMON: CVE-2018-10932 // 
            
            
            
            JVNDB: JVNDB-2018-009348 // 
            
            
            
            PACKETSTORM: 155134 // 
            
            
            
            CNNVD: CNNVD-201808-644 // 
            
            
            
            NVD: CVE-2018-10932

CREDITS
Red Hat
Trust: 0.7
sources:
            
            
            PACKETSTORM: 155134 // 
            
            
            
            CNNVD: CNNVD-201808-644

SOURCES
db:VULHUBid:VHN-120741
db:VULMONid:CVE-2018-10932
db:JVNDBid:JVNDB-2018-009348
db:PACKETSTORMid:155134
db:CNNVDid:CNNVD-201808-644
db:NVDid:CVE-2018-10932

LAST UPDATE DATE
2024-11-23T23:12:04.350000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-120741date:2023-02-12T00:00:00
db:VULMONid:CVE-2018-10932date:2019-10-09T00:00:00
db:JVNDBid:JVNDB-2018-009348date:2018-11-16T00:00:00
db:CNNVDid:CNNVD-201808-644date:2023-04-19T00:00:00
db:NVDid:CVE-2018-10932date:2024-11-21T03:42:20.177

SOURCES RELEASE DATE
db:VULHUBid:VHN-120741date:2018-08-21T00:00:00
db:VULMONid:CVE-2018-10932date:2018-08-21T00:00:00
db:JVNDBid:JVNDB-2018-009348date:2018-11-16T00:00:00
db:PACKETSTORMid:155134date:2019-11-06T15:41:31
db:CNNVDid:CNNVD-201808-644date:2018-08-22T00:00:00
db:NVDid:CVE-2018-10932date:2018-08-21T18:29:00.263