Lucene search

MitreCVE-2020-27853

HistoryOct 27, 2020 - 6:15 p.m.

CVE-2020-27853

2020-10-2718:15:12

CWE-134

mitre

web.nvd.nist.gov

164

cve

2020

27853

wire

denial of service

execute code

format string

avs

secure messenger

android

ios

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.009

Percentile

83.2%

JSON

Wire before 2020-10-16 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a format string. This affects Wire AVS (Audio, Video, and Signaling) 5.3 through 6.x before 6.4, the Wire Secure Messenger application before 3.49.918 for Android, and the Wire Secure Messenger application before 3.61 for iOS. This occurs via the value parameter to sdp_media_set_lattr in peerflow/sdp.c.

Affected configurations

Nvd

Node

wirewireRange<3.21.2936linux

wirewireRange<3.21.3932windows

wirewireRange<3.21.3959macos

wirewire_-_audio\,_video\,_and_signalingRange5.3–6.4

wirewire_secure_messengerRange<3.49.918android

wirewire_secure_messengerRange<3.61iphone_os

VendorProductVersionCPE
wirewire*cpe:2.3:a:wire:wire:*:*:*:*:*:linux:*:*
wirewire*cpe:2.3:a:wire:wire:*:*:*:*:*:windows:*:*
wirewire*cpe:2.3:a:wire:wire:*:*:*:*:*:macos:*:*
wirewire_-_audio\,_video\,_and_signaling*cpe:2.3:a:wire:wire_-_audio\,_video\,_and_signaling:*:*:*:*:*:*:*:*
wirewire_secure_messenger*cpe:2.3:a:wire:wire_secure_messenger:*:*:*:*:*:android:*:*
wirewire_secure_messenger*cpe:2.3:a:wire:wire_secure_messenger:*:*:*:*:*:iphone_os:*:*

Vendor	Product	Version	CPE
wire	wire	*	cpe:2.3:a:wire:wire::::::linux::*
wire	wire	*	cpe:2.3:a:wire:wire::::::windows::*
wire	wire	*	cpe:2.3:a:wire:wire::::::macos::*
wire	wire_-_audio\,_video\,_and_signaling	*	cpe:2.3:a:wire:wire_-_audio\,_video\,_and_signaling::::::::
wire	wire_secure_messenger	*	cpe:2.3:a:wire:wire_secure_messenger::::::android::*
wire	wire_secure_messenger	*	cpe:2.3:a:wire:wire_secure_messenger::::::iphone_os::*

References

github.security.telekom.com/2020/11/wire-secure-messenger-format-string-vulnerability.html

github.com/wireapp/wire-audio-video-signaling/issues/23#issuecomment-710075689

Social References

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.009

Percentile

83.2%

JSON

Related for CVE-2020-27853