Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2013-4550

Bip before 0.8.9, when running as a daemon, writes SSL handshake errors to an unexpected file descriptor that was previously associated with stderr before stderr has been closed, which allows remote attackers to write to other sockets and have an unspecified impact via a failed SSL handshake, a different vulnerability than CVE-2011-5268. NOTE: some sources originally mapped this CVE to two different types of issues; this CVE has since been SPLIT, producing CVE-2011-5268.

Published

2013-12-24T18:55:03.747

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 5.1 (MEDIUM)

CVSSv2 Vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: HIGH
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

4.9

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-310
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System fedoraproject fedora 18 Yes
Operating System fedoraproject fedora 19 Yes
Operating System fedoraproject fedora 20 Yes
Application duckcorp bip ≤ 0.8.8 Yes
Application duckcorp bip 0.8.0 Yes
Application duckcorp bip 0.8.0 Yes
Application duckcorp bip 0.8.0 Yes
Application duckcorp bip 0.8.1 Yes
Application duckcorp bip 0.8.2 Yes
Application duckcorp bip 0.8.3 Yes
Application duckcorp bip 0.8.4 Yes
Application duckcorp bip 0.8.5 Yes
Application duckcorp bip 0.8.6 Yes
Application duckcorp bip 0.8.7 Yes
References