title: AfreecaTV streamer service stack-based buffer overflow
description: The vulnerability function is enabled when the streamer service related to the AfreecaTV communicated through web socket using 21201 port. A stack-based buffer overflow leading to remote code execution was discovered in strcpy() operate by "FanTicket" field. It is because of stored data without validation of length.
problem types: CWE-190 Integer Overflow or Wraparound
affected:
{
platforms: Windows
product: afreecatvstreamer.exe
vendor: AfreecaTV
versions:
lessThanOrEqual: 2020.06.15, status: affected, version: 1.0.0.1, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]