A vulnerability was found in Siretta QUARTZ-GOLD G5.0.1.5-210720-141020 and classified as critical. Affected by this issue is an unknown function of the component DetranCLI Command Parser. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is confidentiality, integrity, and availability. CVE summarizes:

Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.This buffer overflow is in the function that manages the 'gre index tunnel A.B.C.D source (A.B.C.D|null) dest A.B.C.D keepalive (on|off) interval (|null) retry (|null) description (WORD|null)' command template.

The weakness was published 01/27/2023 as TALOS-2022-1613. The advisory is shared for download at talosintelligence.com. This vulnerability is handled as CVE-2022-40999 since 09/19/2022. There are neither technical details nor an exploit publicly available.

Applying a patch is able to eliminate this problem.

Productinfo

Vendor

• Siretta

Name

• QUARTZ-GOLD

Version

• G5.0.1.5-210720-141020

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion