CVE-2018-25356
HIGHSIPp 3.6 Local Buffer Overflow via Command-line Arguments
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2018-25356. PoCs published by Fakhri Zulkifli.
AI-analyzed exploit summary This PoC demonstrates a local buffer overflow in SIPp 3.6-dev by passing a long string (300 'A's) to command-line arguments (-3pcc, -i, -log_file), triggering a strcpy-based overflow. The crash occurs in main() due to unsafe handling of user-supplied input.
Description
SIPp 3.6 and earlier contains a local buffer overflow vulnerability in command-line argument handling that allows local attackers to crash the application or execute arbitrary code. Attackers can trigger the vulnerability by supplying oversized input to the -3pcc, -i, or -log_file parameters, causing strcpy to write beyond buffer boundaries in sipp.cpp.
Exploits (1)
This PoC demonstrates a local buffer overflow in SIPp 3.6-dev by passing a long string (300 'A's) to command-line arguments (-3pcc, -i, -log_file), triggering a strcpy-based overflow. The crash occurs in main() due to unsafe handling of user-supplied input.
References (4)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H