« Volver al listado

CVE-2024-52065

Estado: AnalizadaMedia (6.9)—

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional on non-Windows (Persistence Service) allows Buffer Overflow via Environment Variables.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.1.2 before 6.1.2.21, from 5.3.1.40 before 5.3.1.41.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

RTI — Connext Professional

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-52065",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-52065",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-16T18:15:10.198168Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "3f572a00-62e2-4423-959a-7ea25eff1638",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6.9,
          "Automatable": "NOT_DEFINED",
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "3f572a00-62e2-4423-959a-7ea25eff1638",
      "affectedData": [
        {
          "vendor": "RTI",
          "modules": [
            "Persistence Service"
          ],
          "product": "Connext Professional",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.0",
              "lessThan": "7.3.0.2",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "6.1.1.2",
              "lessThan": "6.1.2.21",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "5.3.1.40",
              "lessThan": "5.3.1.41",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "non-Windows"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-12-13T11:15:09.153",
  "references": [
    {
      "url": "https://www.rti.com/vulnerabilities/#cve-2024-52065",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "3f572a00-62e2-4423-959a-7ea25eff1638"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "3f572a00-62e2-4423-959a-7ea25eff1638",
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional on non-Windows (Persistence Service) allows Buffer Overflow via Environment Variables.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.1.2 before 6.1.2.21, from 5.3.1.40 before 5.3.1.41."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de copia de búfer sin comprobar el tamaño de la entrada ('desbordamiento de búfer clásico') en RTI Connext Professional en sistemas que no son Windows (servicio de persistencia) permite un desbordamiento de búfer a través de variables de entorno. Este problema afecta a Connext Professional: desde la versión 7.0.0 hasta la 7.3.0.2, desde la versión 6.1.1.2 hasta la 6.1.2.21, desde la versión 5.3.1.40 hasta la 5.3.1.41."
    }
  ],
  "lastModified": "2026-06-17T08:06:54.037",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E65F0020-14AC-4966-AAF2-97A73FF72FF4",
              "versionEndExcluding": "6.1.2.21",
              "versionStartIncluding": "6.1.1.2"
            },
            {
              "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F3ED9A74-6AA2-45B2-8473-9B7FF2882C55",
              "versionEndExcluding": "7.3.0.2",
              "versionStartIncluding": "7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:rti:connext_professional:5.3.1.40:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C73C9B5-FE5C-483E-8FD2-A18E6A318CC6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "3f572a00-62e2-4423-959a-7ea25eff1638"
}