CVE-2012-4409

Stack-based buffer overflow in the check_file_head function in extra.c in mcrypt 2.6.8 and earlier allows user-assisted remote attackers to execute arbitrary code via an encrypted file with a crafted header containing long salt data that is not properly handled during decryption.

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

15.14% chance of exploitation in the next 30 days, 96th percentile

Published

2012-11-21

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://packetstormsecurity.org/files/116268/mcrypt-2.6.8-Buffer-Overflow-Proof-Of-Concept…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/22938
• https://www.exploit-db.com/exploits/22928

References

• CVE Record
• NVD entry

Related

• CVE-2012-4399
• CVE-2012-4412
• CVE-2012-4385
• CVE-2012-4415
• CVE-2012-4384
• CVE-2012-4421