cron/entry.c in vixie cron before 9cc8ab1, as used in OpenBSD 7.4 and 7.5, allows a heap-based buffer underflow and memory corruption. NOTE: this issue was introduced during a May 2023 refactoring.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00065.

Exploitation poc

Automatable yes

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
n/a n/a affected
Version Status Constraints
n/a affected —

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Openbsd Subscribe
Openbsd Subscribe
Vixie Subscribe
Cron Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/vixie/cron/commit/9cc8ab1087bb9ab861dd5595c41200683c9f6712 cve-icon cve-icon
https://www.supernetworks.org/CVE-2024-43688/openbsd-cron-heap-underflow.txt cve-icon cve-icon
https://www.supernetworks.org/advisories/CVE-2024-43688-openbsd-cron-heap-underflow.txt cve-icon cve-icon
History

Mon, 26 Aug 2024 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Openbsd
Openbsd openbsd
Vixie
Vixie cron
Weaknesses CWE-787
CPEs cpe:2.3:a:vixie:cron:*:*:*:*:*:*:*:*
cpe:2.3:o:openbsd:openbsd:7.4:*:*:*:*:*:*:*
cpe:2.3:o:openbsd:openbsd:7.5:*:*:*:*:*:*:*
Vendors & Products Openbsd
Openbsd openbsd
Vixie
Vixie cron
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Aug 2024 06:15:00 +0000

Type Values Removed Values Added
References

Thu, 22 Aug 2024 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Aug 2024 06:00:00 +0000

Type Values Removed Values Added
Description cron/entry.c in vixie cron before 9cc8ab1, as used in OpenBSD 7.4 and 7.5, allows a heap-based buffer underflow and memory corruption. NOTE: this issue was introduced during a May 2023 refactoring.
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-08-26T13:23:36.277Z

Reserved: 2024-08-14T00:00:00

Link: CVE-2024-43688

cve-icon Vulnrichment

Updated: 2024-08-22T14:27:18.899Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-08-20T06:15:04.983

Modified: 2024-08-26T14:35:06.680

Link: CVE-2024-43688

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses