CVE-2023-46316 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.5 MEDIUM	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CISA-ADP	ADP	5.5 MEDIUM	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 11%

Affected Products (NVD)

Vendor	Product	Version
buc	traceroute	2.0.12 ≤ 𝑥 < 2.1.3
debian	debian_linux	10.0
debian	debian_linux	11.0
debian	debian_linux	12.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

traceroute

bookworm	no-dsa
bullseye	no-dsa
buster	no-dsa
sid	1:2.1.6-1 fixed
trixie	1:2.1.6-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

traceroute

bionic	Fixed 1:2.1.0-2ubuntu0.18.04.1~esm1 released
focal	Fixed 1:2.1.0-2ubuntu0.20.04.1~esm1 released
jammy	Fixed 1:2.1.0-2ubuntu0.22.04.1~esm1 released
lunar	ignored
mantic	ignored
noble	needs-triage
oracular	needs-triage
trusty	Fixed 1:2.0.20-0ubuntu0.1+esm1 released
xenial	Fixed 1:2.0.21-1ubuntu0.1~esm1 released

Common Weakness Enumeration

CWE-234 - Failure to Handle Missing Parameter
If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.

References

http://packetstormsecurity.com/files/176660/Traceroute-2.1.2-Privilege-Escalation.html

https://security-tracker.debian.org/tracker/CVE-2023-46316

https://sourceforge.net/projects/traceroute/files/traceroute/traceroute-2.1.3/

http://packetstormsecurity.com/files/176660/Traceroute-2.1.2-Privilege-Escalation.html

https://security-tracker.debian.org/tracker/CVE-2023-46316

https://sourceforge.net/projects/traceroute/files/traceroute/traceroute-2.1.3/