CVE-2024-4599 - Vulnerability Details - OpenCVE

Remote denial of service vulnerability in LAN Messenger affecting version 3.4.0. This vulnerability allows an attacker to crash the LAN Messenger service by sending a long string directly and continuously over the UDP protocol.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00697.

Key SSVC decision points have not yet been added.

Vendors	Products
Lan Messenger Subscribe	Lan Messenger Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products
Lan Messenger Subscribe	Lan Messenger Subscribe

Advisories

Source	ID	Title
EUVD	EUVD-2024-44208	Remote denial of service vulnerability in LAN Messenger affecting version 3.4.0. This vulnerability allows an attacker to crash the LAN Messenger service by sending a long string directly and continuously over the UDP protocol.

Fixes

Solution

There is no reported solution at this time.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.incibe.es/en/incibe-cert/notices/aviso/denial-service-vulnerability-lan-messenger

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: INCIBE

Published: 2024-05-07T10:48:39.295Z

Updated: 2024-08-01T20:47:41.238Z

Reserved: 2024-05-07T07:49:48.173Z

Link: CVE-2024-4599

Vulnrichment

Updated: 2024-08-01T20:47:41.238Z

NVD

Status : Awaiting Analysis

Published: 2024-05-07T11:15:50.447

Modified: 2024-11-21T09:43:11.260

Link: CVE-2024-4599

Redhat

No data.

OpenCVE Enrichment

Updated: 2025-07-13T11:14:33Z

Weaknesses

CWE-400

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-4599", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "state": "PUBLISHED", "assignerShortName": "INCIBE", "dateReserved": "2024-05-07T07:49:48.173Z", "datePublished": "2024-05-07T10:48:39.295Z", "dateUpdated": "2024-08-01T20:47:41.238Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "LAN Messenger", "vendor": "LAN Messenger", "versions": [{"status": "affected", "version": "3.4.0"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Rafael Pedrero"}], "datePublic": "2024-05-07T10:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Remote denial of service vulnerability in LAN Messenger affecting version 3.4.0. This vulnerability allows an attacker to crash the LAN Messenger service by sending a long string directly and continuously over the UDP protocol."}], "value": "Remote denial of service vulnerability in LAN Messenger affecting version 3.4.0. This vulnerability allows an attacker to crash the LAN Messenger service by sending a long string directly and continuously over the UDP protocol."}], "impacts": [{"capecId": "CAPEC-147", "descriptions": [{"lang": "en", "value": "CAPEC-147 XML Ping of the Death"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2024-05-07T10:48:39.295Z"}, "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/denial-service-vulnerability-lan-messenger"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "There is no reported solution at this time."}], "value": "There is no reported solution at this time."}], "source": {"discovery": "EXTERNAL"}, "title": "Denial of service vulnerability in LAN Messenger", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-4599", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-07T14:50:13.155261Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:lan_messenger:lan_messenger:*:*:*:*:*:*:*:*"], "vendor": "lan_messenger", "product": "lan_messenger", "versions": [{"status": "affected", "version": "3.4.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:53:15.765Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:47:41.238Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/denial-service-vulnerability-lan-messenger", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/denial-service-vulnerability-lan-messenger", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:47:41.238Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-4599", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-07T14:50:13.155261Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:lan_messenger:lan_messenger:*:*:*:*:*:*:*:*"], "vendor": "lan_messenger", "product": "lan_messenger", "versions": [{"status": "affected", "version": "3.4.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-07T14:49:30.316Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Denial of service vulnerability in LAN Messenger", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Rafael Pedrero"}], "impacts": [{"capecId": "CAPEC-147", "descriptions": [{"lang": "en", "value": "CAPEC-147 XML Ping of the Death"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "LAN Messenger", "product": "LAN Messenger", "versions": [{"status": "affected", "version": "3.4.0"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "There is no reported solution at this time.", "supportingMedia": [{"type": "text/html", "value": "There is no reported solution at this time.", "base64": false}]}], "datePublic": "2024-05-07T10:00:00.000Z", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/denial-service-vulnerability-lan-messenger"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Remote denial of service vulnerability in LAN Messenger affecting version 3.4.0. This vulnerability allows an attacker to crash the LAN Messenger service by sending a long string directly and continuously over the UDP protocol.", "supportingMedia": [{"type": "text/html", "value": "Remote denial of service vulnerability in LAN Messenger affecting version 3.4.0. This vulnerability allows an attacker to crash the LAN Messenger service by sending a long string directly and continuously over the UDP protocol.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2024-05-07T10:48:39.295Z"}}}, "cveMetadata": {"cveId": "CVE-2024-4599", "state": "PUBLISHED", "dateUpdated": "2024-08-01T20:47:41.238Z", "dateReserved": "2024-05-07T07:49:48.173Z", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "datePublished": "2024-05-07T10:48:39.295Z", "assignerShortName": "INCIBE"}, "dataVersion": "5.1"}