Vulnerabilities > CVE-2020-27853 - Use of Externally-Controlled Format String vulnerability in Wire products

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

wire

CWE-134

critical

NVD

Published: 2020-10-27

Updated: 2020-12-07

Summary

Wire before 2020-10-16 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a format string. This affects Wire AVS (Audio, Video, and Signaling) 5.3 through 6.x before 6.4, the Wire Secure Messenger application before 3.49.918 for Android, and the Wire Secure Messenger application before 3.61 for iOS. This occurs via the value parameter to sdp_media_set_lattr in peerflow/sdp.c.

Vulnerable Configurations

Part	Description	Count
Application	Wire Wire Wire Secure Messenger * Wire Wire Audio, Video, AND Signaling * Wire Wire 3.5.2881 Wire Wire 3.6.2885 Wire Wire 3.7.2891 Wire Wire 3.8.2894 Wire Wire 3.9.2895 Wire Wire 3.10.2904 Wire Wire 3.11.2912 Wire Wire 3.12.2916 Wire Wire 3.15.2922 Wire Wire 3.16.2923 Wire Wire 3.17.2924 Wire Wire 3.18.2925 Wire Wire 3.19.2928 Wire Wire 3.20.2934 Wire Wire 2.15.2750 Wire Wire 3.5.2910 Wire Wire 3.6.2923 Wire Wire 3.7.2930 Wire Wire 3.8.2940 Wire Wire 3.9.2943 Wire Wire 3.10.3133 Wire Wire 3.10.3215 Wire Wire 3.12.3490 Wire Wire 3.15.3621 Wire Wire 3.16.3630 Wire Wire 3.17.3666 Wire Wire 3.18.3728 Wire Wire 3.19.3799 Wire Wire 3.20.3912 Wire Wire 3.5.2899 Wire Wire 3.6.2908 Wire Wire 3.7.2917 Wire Wire 3.8.2927 Wire Wire 3.9.2928 Wire Wire 3.10.3138 Wire Wire 3.11.3259 Wire Wire 3.12.3423 Wire Wire 3.15.3551 Wire Wire 3.16.3562 Wire Wire 3.17.3598 Wire Wire 3.18.3660 Wire Wire 3.19.3731 Wire Wire 3.20.3890	46

Common Weakness Enumeration (CWE)

CWE-134 - Use of Externally-Controlled Format String

Common Attack Pattern Enumeration and Classification (CAPEC)

Format String Injection
An attacker includes formatting characters in a string input field on the target application. Most applications assume that users will provide static text and may respond unpredictably to the presence of formatting character. For example, in certain functions of the C programming languages such as printf, the formatting character %s will print the contents of a memory location expecting this location to identify a string and the formatting character %n prints the number of DWORD written in the memory. An attacker can use this to read or write to memory locations or files, or simply to manipulate the value of the resulting text in unexpected ways. Reading or writing memory may result in program crashes and writing memory could result in the execution of arbitrary code if the attacker can write to the program stack.
String Format Overflow in syslog()
This attack targets the format string vulnerabilities in the syslog() function. An attacker would typically inject malicious input in the format string parameter of the syslog function. This is a common problem, and many public vulnerabilities and associated exploits have been posted.

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

References