Vulnerability Spotlight: Epee Levin Packet Deserialization Code Execution Vulnerability
Threat Research
Vulnerability Spotlight: Epee Levin Packet Deserialization Code Execution Vulnerability
This vulnerability was discovered by Lilith (>_>) of Cisco Talos.
Overview
The Epee library, which is leveraged by a large number of cryptocurrencies, contains an exploitable code execution vulnerability in the Levin deserialization functionality. An attacker can send a specially crafted network packet to cause a logic flaw, resulting in remote code execution.
In accordance with our coordinated disclosure policy, Cisco Talos has worked with the developers of Monero ‘Lithium Luna’ to ensure that these issues have been resolved and that an update has been made available for affected users. It is recommended that this update is applied as quickly as possible to ensure that systems are no longer affected by this vulnerability.
from Cisco Blog » Security https://ift.tt/2zt3NPx