[ASA-202102-39] ipmitool: arbitrary code execution
foxboron at archlinux.org
Mon Mar 1 22:24:08 UTC 2021
Arch Linux Security Advisory ASA-202102-39
Date : 2021-02-27
CVE-ID : CVE-2020-5208
Package : ipmitool
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-1596
The package ipmitool before version 1.8.18-7 is vulnerable to arbitrary
Upgrade to 1.8.18-7.
# pacman -Syu "ipmitool>=1.8.18-7"
The problem has been fixed upstream but no release is available yet.
It's been found that multiple functions in ipmitool before 1.8.19
neglect proper checking of the data received from a remote LAN party,
which may lead to buffer overflows and potentially to remote code
execution on the ipmitool side. This is especially dangerous if
ipmitool is run as a privileged user. This problem is fixed in version
A remote server could execute arbitrary code on the client.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the arch-security