Denial of Service in PCP pmproxy via Memory Corruption

Executive Summary

This vulnerability is in the PCP pmproxy service. A remote attacker can send a specially crafted request to exploit a flaw in the pmLogLoadInDom() function. This bypasses a bounds check, causing the service to crash (Denial of Service) and potentially leaking sensitive system memory information.

Useful 0 Not Useful 0

Detection Guidance

Check if the PCP pmproxy service is running on TCP port 44322. Use commands like 'ss -tulnp | grep 44322' or 'netstat -tulnp | grep 44322' to verify. Inspect pmproxy logs for crashes or unusual activity. Monitor for unexpected memory leaks or crashes in the pmproxy process.

Useful 0 Not Useful 0

Impact Analysis

An attacker could crash the pmproxy service, disrupting its operations. They might also access sensitive system memory, leading to information leakage. Exploitation requires access to TCP port 44322 and a valid archive ID, which can be obtained without authentication.

Useful 0 Not Useful 0

Mitigation Strategies

Update PCP to the latest patched version. If an update is unavailable, restrict access to TCP port 44322 using firewall rules. Disable the pmproxy service if not required. Monitor for exploitation attempts via logs and network traffic.

Useful 0 Not Useful 0