CVE-2013-2038

Severity Score

4.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The NMEA0183 driver in gpsd before 3.9 allows remote attackers to cause a denial of service (daemon termination) and possibly execute arbitrary code via a GPS packet with a malformed $GPGGA interpreted sentence that lacks certain fields and a terminator. NOTE: a separate issue in the AIS driver was also reported, but it might not be a vulnerability.

El driver NMEA0183 en gpsd anterior a 3.9 permite a atacantes remotos causar una denegación de servicio (finalización del demonio) y posiblemente ejecutar código arbitrario a través de un paquete GPS con una secuencia interpretada $GPGGA malformada que carece de ciertos campos y de terminador. NOTA: un problema a parte en el driver AIS se ha reportado también, pero podría no ser una vulnerabilidad.

*Credits: N/A

CVSS Scores

NISTv2 4.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2013-02-19 CVE Reserved
2013-05-08 CVE Published
2024-02-05 EPSS Updated
2024-08-06 CVE Updated
2024-08-06 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-20: Improper Input Validation

CAPEC

References (7)

URL	Tag	Source
http://lists.nongnu.org/archive/html/gpsd-dev/2013-05/msg00000.html	Mailing List
http://openwall.com/lists/oss-security/2013/05/02/20	Mailing List
http://openwall.com/lists/oss-security/2013/05/08/1	Mailing List
http://www.osvdb.org/93000	Vdb Entry
http://www.osvdb.org/93001	Vdb Entry

URL	Date	SRC
http://git.savannah.gnu.org/cgit/gpsd.git/commit/?id=dd9c3c2830cb8f8fd8491ce68c82698dc5538f50	2024-08-06

URL	Date	SRC

URL	Date	SRC
http://ubuntu.com/usn/usn-1820-1	2014-02-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Gpsd Project Search vendor "Gpsd Project"		Gpsd Search vendor "Gpsd Project" for product "Gpsd"				<= 3.8 Search vendor "Gpsd Project" for product "Gpsd" and version " <= 3.8"		-		Affected
Gpsd Project Search vendor "Gpsd Project"		Gpsd Search vendor "Gpsd Project" for product "Gpsd"				3.0 Search vendor "Gpsd Project" for product "Gpsd" and version "3.0"		-		Affected
Gpsd Project Search vendor "Gpsd Project"		Gpsd Search vendor "Gpsd Project" for product "Gpsd"				3.1 Search vendor "Gpsd Project" for product "Gpsd" and version "3.1"		-		Affected
Gpsd Project Search vendor "Gpsd Project"		Gpsd Search vendor "Gpsd Project" for product "Gpsd"				3.2 Search vendor "Gpsd Project" for product "Gpsd" and version "3.2"		-		Affected
Gpsd Project Search vendor "Gpsd Project"		Gpsd Search vendor "Gpsd Project" for product "Gpsd"				3.3 Search vendor "Gpsd Project" for product "Gpsd" and version "3.3"		-		Affected
Gpsd Project Search vendor "Gpsd Project"		Gpsd Search vendor "Gpsd Project" for product "Gpsd"				3.4 Search vendor "Gpsd Project" for product "Gpsd" and version "3.4"		-		Affected
Gpsd Project Search vendor "Gpsd Project"		Gpsd Search vendor "Gpsd Project" for product "Gpsd"				3.5 Search vendor "Gpsd Project" for product "Gpsd" and version "3.5"		-		Affected
Gpsd Project Search vendor "Gpsd Project"		Gpsd Search vendor "Gpsd Project" for product "Gpsd"				3.6 Search vendor "Gpsd Project" for product "Gpsd" and version "3.6"		-		Affected
Gpsd Project Search vendor "Gpsd Project"		Gpsd Search vendor "Gpsd Project" for product "Gpsd"				3.7 Search vendor "Gpsd Project" for product "Gpsd" and version "3.7"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				12.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04"		lts		Affected