« Volver al listado

CVE-2012-3368

Estado: ModificadaBaja (2.6)—

Error de entero sin signo en attach.c en dtach v0.8 permite a atacantes remotos obtener información sensible desde el demonio de la pila de memoria en circunstancias oportunas leyendo datos de la aplicación después de una petición de cerrado de conexión (connection-close) irregular, como se demostró ejecutando un cliente de IRC en dtach.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Redhat — Dtach

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2012-3368",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.6,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 4.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-07-03T21:55:01.567",
  "references": [
    {
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=625302",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://sourceforge.net/tracker/?func=detail&aid=3517812&group_id=36489&atid=417357",
      "tags": [
        "Exploit"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://sourceforge.net/tracker/download.php?group_id=36489&atid=417357&file_id=441195&aid=3517812",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=812551",
      "tags": [
        "Exploit"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=835849",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=625302",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sourceforge.net/tracker/?func=detail&aid=3517812&group_id=36489&atid=417357",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sourceforge.net/tracker/download.php?group_id=36489&atid=417357&file_id=441195&aid=3517812",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=812551",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=835849",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-189"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Integer signedness error in attach.c in dtach 0.8 allows remote attackers to obtain sensitive information from daemon stack memory in opportunistic circumstances by reading application data after an improper connection-close request, as demonstrated by running an IRC client in dtach."
    },
    {
      "lang": "es",
      "value": "Error de entero sin signo en attach.c en dtach v0.8 permite a atacantes remotos obtener información sensible desde el demonio de la pila de memoria en circunstancias oportunas leyendo datos de la aplicación después de una petición de cerrado de conexión (connection-close) irregular, como se demostró ejecutando un cliente de IRC en dtach."
    }
  ],
  "lastModified": "2026-06-16T23:43:05.320",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:dtach:0.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E0367B7-1BA3-40EE-A670-558E079DFF4E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}