Skip to content
OpenAdvisories
High ALAS2-2020-1420 1 CVE

Important: ipmitool security update (Amazon Linux 2)

Published May 5, 2020 · Updated May 6, 2020

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-5208: It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. This problem is fixed in version 1.8.19. 1798721: CVE-2020-5208 ipmitool: Buffer overflow in read_fru_area_section function in lib/ipmi_fru.c

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 bmc-snmp-proxy 0:1.8.18-9.amzn2
Amazon Linux · 2 exchange-bmc-os-info 0:1.8.18-9.amzn2
Amazon Linux · 2 ipmitool 0:1.8.18-9.amzn2
Amazon Linux · 2 ipmitool-debuginfo 0:1.8.18-9.amzn2

Vulnerabilities 1

  • High 7.7
    CVE-2020-5208

    remote code execution vulnerability in ipmitool

    It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially danger…

    ipmitool ipmitool ipmitool ipmitool Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-5208.html