Sliver HTTP(S) listener PNG decoder memory exhaustion halts server
A remote control tool server can be knocked offline.
Summary
The HTTP(S) listener in the Sliver command and control framework accepts PNG images without a decoded-size limit, so they can exhaust server memory. An unauthenticated attacker who finds a valid nonce can take the server completely offline.
Affected when
- HTTP(S) listener using the PNG encoder
What to do
Update to 1.7.6.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen