← The IT Show

Security · MOOS-IvP MOOS-IvP

MOOS-IvP through 24.8.1 Affected by Command Injection and Out-of-Bounds Read Flaws

Published 20 minutes ago · Updated 20 minutes ago

MOOS-IvP versions through 24.8.1 contain a command injection vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir(), which fails to sanitize shell metacharacters in log file pathnames or the --dir parameter, allowing arbitrary command execution with the privileges of the operator running alogsplit. A separate out-of-bounds read affects the isQuoted(), isBraced(), and isChevroned() functions, which strip whitespace but index using the original string length, letting attackers send NODE_REPORT messages with leading or trailing whitespace to read adjacent memory.

Read the original coverage at CVE.org
Captured 24 minutes ago