CVE-2024-52064

Potential stack buffer write overflow in Connext applications while parsing malicious license file

Severity Score

6.9

*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40, from 5.0.0 before 5.3.1.45.

*Credits: N/A

CVSS Scores

RTIv4 6.9

Attack Vector

Local

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

System

Vulnerable | Subsequent

Confidentiality

None

Integrity

High

None

Availability

Low

None

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-11-05 CVE Reserved
2024-12-13 CVE Published
2024-12-14 EPSS Updated
2024-12-16 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CAPEC

CAPEC-46: Overflow Variables and Tags

References (1)

URL	Tag	Source
https://www.rti.com/vulnerabilities/#cve-2024-52064

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
RTI Search vendor "RTI"		Connext Professional Search vendor "RTI" for product "Connext Professional"				>= 7.0.0.0 < 7.3.0.2 Search vendor "RTI" for product "Connext Professional" and version " >= 7.0.0.0 < 7.3.0.2"		en		Affected
RTI Search vendor "RTI"		Connext Professional Search vendor "RTI" for product "Connext Professional"				>= 6.1.0.0 < 6.1.2.21 Search vendor "RTI" for product "Connext Professional" and version " >= 6.1.0.0 < 6.1.2.21"		en		Affected
RTI Search vendor "RTI"		Connext Professional Search vendor "RTI" for product "Connext Professional"				>= 6.0.0.0 < 6.0.1.40 Search vendor "RTI" for product "Connext Professional" and version " >= 6.0.0.0 < 6.0.1.40"		en		Affected
RTI Search vendor "RTI"		Connext Professional Search vendor "RTI" for product "Connext Professional"				>= 5.0.0.0 < 5.3.1.45 Search vendor "RTI" for product "Connext Professional" and version " >= 5.0.0.0 < 5.3.1.45"		en		Affected