CyberRota Analysis
AI-GeneratedWazuh versions 4.5.0 to 4.14.6 and 5.0.0-beta2 are vulnerable due to a flaw in the compare_wazuh_versions() function, which improperly handles an attacker-controlled buffer, leading to potential stack memory corruption. This vulnerability can be exploited remotely to cause a denial of service, particularly when anonymous TLS enrollment is enabled and the service is accessible on TCP port 1515. Organizations using affected versions should prioritize upgrading to versions 4.14.6 or 5.0.0-beta2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.5.0 until 4.14.6 and 5.0.0-beta2, compare_wazuh_versions() in src/shared/version_op.c copies the attacker-controlled enrollment V: field into a 10-byte stack buffer with strncpy() but does not explicitly terminate the buffer. The function is reachable before authentication through wazuh-authd on TCP port 1515 when anonymous TLS enrollment is enabled. A version string of at least nine non-null bytes can cause strchr() and strtok() to read beyond ver2 and can make strtok() write a null byte into adjacent stack memory, allowing a remote denial of service. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.
Related CVEs
Other vulnerabilities affecting the same vendor(s)