CVE-2019-13132
CRITICALZeroMQ libzmq < 4.0.9, 4.1.x < 4.1.7, 4.2.x < 4.3.2 - Unauthenticated Stack Overflow via CURVE Encryption/Authentication
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2019-13132. PoCs published by dinosn.
AI-analyzed exploit summary This repository contains a fully functional exploit for CVE-2019-13132, a stack buffer overflow in libzmq's CURVE INITIATE handshake handler. The exploit includes a Dockerized lab environment, a Python-based exploit script, and detailed technical documentation explaining the vulnerability and exploitation process.
Description
In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due to a buffer overflow in the library. Users running public servers with the above configuration are highly encouraged to upgrade as soon as possible, as there are no known mitigations.
Exploits (1)
This repository contains a fully functional exploit for CVE-2019-13132, a stack buffer overflow in libzmq's CURVE INITIATE handshake handler. The exploit includes a Dockerized lab environment, a Python-based exploit script, and detailed technical documentation explaining the vulnerability and exploitation process.
References (15)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H