CVE-2020-5208

Description

Its been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. This problem is fixed in version 1.8.19.

Risk Information

Base Score

8.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.571

Associated Vulnerability

Vulnerability	OS Platform
SUSE-SU-2020:0630-1(SUSE Linux Enterprise Server 12-SP4 ) ipmitool-1.8.18-5.9.1.x86_64.rpm	Linux
SUSE-SU-2020:0630-1(SUSE Linux Enterprise Server 12-SP5 ) ipmitool-1.8.18-5.9.1.x86_64_SP5.rpm	Linux
SUSE-SU-2020:0630-1(SUSE Linux Enterprise Server 12-SP4 ) ipmitool-debuginfo-1.8.18-5.9.1.x86_64.rpm	Linux
SUSE-SU-2020:0630-1(SUSE Linux Enterprise Server 12-SP5 ) ipmitool-debuginfo-1.8.18-5.9.1.x86_64_SP5.rpm	Linux
SUSE-SU-2020:0630-1(SUSE Linux Enterprise Server 12-SP4 ) ipmitool-debugsource-1.8.18-5.9.1.x86_64.rpm	Linux
SUSE-SU-2020:0630-1(SUSE Linux Enterprise Server 12-SP5 ) ipmitool-debugsource-1.8.18-5.9.1.x86_64_SP5.rpm	Linux
SUSE-SU-2020:0630-1(SUSE Linux Enterprise Desktop 12-SP4 ) ipmitool-1.8.18-5.9.1.x86_64_SP4.rpm	Linux
SUSE-SU-2020:0630-1(SUSE Linux Enterprise Desktop 12-SP4 ) ipmitool-debuginfo-1.8.18-5.9.1.x86_64_SP4.rpm	Linux
SUSE-SU-2020:0630-1(SUSE Linux Enterprise Desktop 12-SP4 ) ipmitool-debugsource-1.8.18-5.9.1.x86_64_SP4.rpm	Linux
(RHSA-2020:0984) ipmitool security update bmc-snmp-proxy-1.8.18-9.el7_7.noarch.rpm	Linux
(RHSA-2020:0984) ipmitool security update exchange-bmc-os-info-1.8.18-9.el7_7.noarch.rpm	Linux
(RHSA-2020:0984) ipmitool security update ipmitool-1.8.18-9.el7_7.x86_64.rpm	Linux
(RHSA-2020:1331) ipmitool security update ipmitool-1.8.15-3.el6_10.i686.rpm	Linux
(RHSA-2020:1331) ipmitool security update ipmitool-1.8.15-3.el6_10.x86_64.rpm	Linux
(RHSA-2020:0981) ipmitool security update exchange-bmc-os-info-1.8.18-12.el8_1.noarch.rpm	Linux
(RHSA-2020:0981) ipmitool security update ipmievd-1.8.18-12.el8_1.x86_64.rpm	Linux
(RHSA-2020:0981) ipmitool security update ipmitool-1.8.18-12.el8_1.x86_64.rpm	Linux
(RHSA-2020:0981) ipmitool security update ipmitool-debugsource-1.8.18-12.el8_1.x86_64.rpm	Linux
Ipmievd update (ELSA-2020-0981) ipmievd-1.8.18-12.el8_1.x86_64.rpm	Linux
Ipmitool update (ELSA-2020-0981) ipmitool-1.8.18-12.el8_1.x86_64.rpm	Linux
Exchange-bmc-os-info update (ELSA-2020-0981) exchange-bmc-os-info-1.8.18-12.el8_1.noarch.rpm	Linux
(CESA-2020:0981) ipmitool security update exchange-bmc-os-info-1.8.18-12.el8_1.noarch.rpm	Linux
(CESA-2020:0981) ipmitool security update ipmievd-1.8.18-12.el8_1.x86_64.rpm	Linux
(CESA-2020:0981) ipmitool security update ipmitool-1.8.18-12.el8_1.x86_64.rpm	Linux
(CESA-2020:0984) ipmitool security update bmc-snmp-proxy-1.8.18-9.el7_7.noarch.rpm	Linux
(CESA-2020:0984) ipmitool security update exchange-bmc-os-info-1.8.18-9.el7_7.noarch.rpm	Linux
(CESA-2020:0984) ipmitool security update ipmitool-1.8.18-9.el7_7.x86_64.rpm	Linux
(CESA-2020:1331) ipmitool security update ipmitool-1.8.15-3.el6_10.i686.rpm	Linux
(CESA-2020:1331) ipmitool security update ipmitool-1.8.15-3.el6_10.x86_64.rpm	Linux
utility for IPMI control with kernel driver or LAN interface (dae (USN-5997-1) ipmitool_1.8.18-5ubuntu0.2_i386.deb	Linux
utility for IPMI control with kernel driver or LAN interface (dae (USN-5997-1) ipmitool_1.8.18-5ubuntu0.2_amd64.deb	Linux
utility for IPMI control with kernel driver or LAN interface (dae (USN-5997-1) ipmitool_1.8.18-8ubuntu0.1_amd64.deb	Linux
(RHSA-2020:0981)Important: security update ipmievd-debuginfo-1.8.18-12.el8_1.x86_64.rpm	Linux
(RHSA-2020:0981)Important: security update ipmitool-debuginfo-1.8.18-12.el8_1.x86_64.rpm	Linux
(RHSA-2020:0984)Important: security update ipmitool-debuginfo-1.8.18-9.el7_7.x86_64.rpm	Linux
ipmitool Security Update (ALAS-2020-1420) ipmitool-1.8.18-9.amzn2.x86_64.rpm	Linux
ipmitool Security Update (ALAS-2020-1420) bmc-snmp-proxy-1.8.18-9.amzn2.noarch.rpm	Linux
ipmitool Security Update (ALAS-2020-1420) exchange-bmc-os-info-1.8.18-9.amzn2.noarch.rpm	Linux
CVE-2020-5208	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234