CVE-2024-52065

Potential stack buffer write overflow in Persistence Service while parsing malicious environment variable on non-Windows systems

Severity Score

6.9

*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional on non-Windows (Persistence Service) allows Buffer Overflow via Environment Variables.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.1.2 before 6.1.2.21, from 5.3.1.40 before 5.3.1.41.

*Credits: N/A

CVSS Scores

RTIv4 6.9

Attack Vector

Local

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

System

Vulnerable | Subsequent

Confidentiality

None

Integrity

High

None

Availability

Low

None

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-11-05 CVE Reserved
2024-12-13 CVE Published
2024-12-14 EPSS Updated
2024-12-16 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CAPEC

CAPEC-10: Buffer Overflow via Environment Variables

References (1)

URL	Tag	Source
https://www.rti.com/vulnerabilities/#cve-2024-52065

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
RTI Search vendor "RTI"		Connext Professional Search vendor "RTI" for product "Connext Professional"				>= 7.0.0.0 < 7.3.0.2 Search vendor "RTI" for product "Connext Professional" and version " >= 7.0.0.0 < 7.3.0.2"		en		Affected
RTI Search vendor "RTI"		Connext Professional Search vendor "RTI" for product "Connext Professional"				>= 6.1.1.2 < 6.1.2.21 Search vendor "RTI" for product "Connext Professional" and version " >= 6.1.1.2 < 6.1.2.21"		en		Affected
RTI Search vendor "RTI"		Connext Professional Search vendor "RTI" for product "Connext Professional"				>= 5.3.1.40 < 5.3.1.41 Search vendor "RTI" for product "Connext Professional" and version " >= 5.3.1.40 < 5.3.1.41"		en		Affected