CVE-2016-5408 — CRITICAL (9.8)

Vulnerability Description

Stack-based buffer overflow in the munge_other_line function in cachemgr.cgi in the squid package before 3.1.23-16.el6_8.6 in Red Hat Enterprise Linux 6 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-4051.

CVSS Score

9.8

CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Oracle	Linux	6
Redhat	Enterprise Linux Server	6.0
Redhat	Enterprise Linux Workstation	6.0

Related Weaknesses (CWE)

CWE-119

References

http://rhn.redhat.com/errata/RHSA-2016-1573.htmlPatchVendor Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.hThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1573.htmlPatchVendor Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.hThird Party Advisory

FAQ

What is CVE-2016-5408?

CVE-2016-5408 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Stack-based buffer overflow in the munge_other_line function in cachemgr.cgi in the squid package before 3.1.23-16.el6_8.6 in Red Hat Enterprise Linux 6 allows remote attackers to execute arbitrary co...

How severe is CVE-2016-5408?

CVE-2016-5408 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2016-5408?

Check the references section above for vendor advisories and patch information. Affected products include: Oracle Linux, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation.