CVE-2019-5164

An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2. Specially crafted network packets sent to ss-manager can cause an arbitrary binary to run, resulting in code execution and privilege escalation. An attacker can send network packets to trigger this vulnerability.

Affected

Shadowsocks

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.0 CISCO

7.8 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

4.6 MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.76% chance of exploitation in the next 30 days, 55th percentile

Published

2019-12-03

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0958

Security advisories

• http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00023.html
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00061.html

References

• CVE Record
• NVD entry