vulnwire
8.1high

CVE-2016-5017

Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before 3.5.3, when using the "cmd:" batch mode syntax, allows…

Published 10 y ago · modified 4 mo ago · JSON

CVSS
8.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
6.8%
percentile 94%
Public exploits
0
none known

Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before 3.5.3, when using the "cmd:" batch mode syntax, allows attackers to have unspecified impact via a long command string.

Exploit prediction (EPSS)

6.79% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.08.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.06.8AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

  • openwall.com /lists/oss-security/2016/09/17/3 · mailing-list, x_refsource_MLIST, x_transferred
  • securityfocus.com /bid/93044 · vdb-entry, x_refsource_BID, x_transferred
  • lists.apache.org /thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.ap · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.a · mailing-list, x_refsource_MLIST, x_transferred
  • oracle.com /security-alerts/cpujul2020.html · x_refsource_MISC, x_transferred
  • cloudera.com /documentation/other/security-bulletins/topics/csb_topic_1.html · x_refsource_CONFIRM, x_transferred
  • git-wip-us.apache.org /repos/asf?p=zookeeper.git%3Ba=commitdiff%3Bh=27ecf981a15554dc8e64a28630af7a5c9e2bdf4f · x_refsource_CONFIRM, x_transferred
  • zookeeper.apache.org /security.html#CVE-2016-5017 · x_refsource_CONFIRM, x_transferred
  • packetstormsecurity.com /files/138755/ZooKeeper-3.4.8-3.5.2-Buffer-Overflow.html · x_refsource_MISC, x_transferred
  • git-wip-us.apache.org /repos/asf?p=zookeeper.git%3Ba=commitdiff%3Bh=f09154d6648eeb4ec5e1ac8a2bacbd2f8c87c14a · x_refsource_CONFIRM, x_transferred
  • lists.apache.org /thread.html/r4b743f407244294f316325458ccaabfce9cd70ca3a6423dbe574035c%40%3Cnotifications. · mailing-list, x_refsource_MLIST, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.