vendor:
lbreakout2
by:
vade79/v9 v9@fakehalo.deadpig.org (fakehalo)
7.5
CVSS
HIGH
Format string
134
CWE
Product Name: lbreakout2
Affected Version From: 2.5-beta1
Affected Version To: 2.5+
Patch Exists: NO
Related CWE: Unknown
CPE: a:lbreakout2:lbreakout2
Platforms Tested: Linux
Unknown
lbreakout2 format string vulnerability
lbreakout2 is vulnerable to a format string issue in the login component. This vulnerability allows an attacker to execute arbitrary code on a vulnerable host. The exploit takes advantage of a format string bug in the initial login request. By sending a specially crafted packet containing shellcode and a format string buffer, an attacker can overwrite memory and execute arbitrary code.
Mitigation:
The vendor has not provided a patch or mitigation for this vulnerability. It is recommended to avoid using lbreakout2 or to update to a patched version if available.