SB2019103119 - Multiple vulnerabilities in call-cc Chicken Scheme

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019103119

SB2019103119 - Multiple vulnerabilities in call-cc Chicken Scheme

Published: October 31, 2019 Updated: August 8, 2020

Security Bulletin ID SB2019103119
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2012-6123)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Chicken before 4.8.0 does not properly handle NUL bytes in certain strings, which allows an attacker to conduct "poisoned NUL byte attack."


2) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CVE-ID: CVE-2012-6124)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

A casting error in Chicken before 4.8.0 on 64-bit platform caused the random number generator to return a constant value. NOTE: the vendor states "This function wasn't used for security purposes (and is advertised as being unsuitable)."


3) Input validation error (CVE-ID: CVE-2012-6125)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Chicken before 4.8.0 is susceptible to algorithmic complexity attacks related to hash table collisions.


Remediation

Install update from vendor's website.

References