PT-2017-15617 · Cesanta · Mongoose

Publicado 2017-11-07 · Atualizado 2022-06-13 · CVE-2017-2921

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose version 6.8

Description A memory corruption issue exists in the Websocket protocol implementation. A specially crafted websocket packet can cause an integer overflow, leading to a heap buffer overflow, which may result in denial of service and potential remote code execution. An attacker can trigger this issue by sending a specially crafted websocket packet over the network.

Recommendations For Cesanta Mongoose version 6.8, consider disabling the Websocket protocol implementation until a patch is available. Restrict access to the network to minimize the risk of exploitation. Avoid using the vulnerable Websocket protocol implementation in production environments until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

CVE-2017-2921

Produtos afetados

Mongoose

Referências · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2017-0428 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2017-2921 · Aviso do Fabricante
• https://t.me/cvenotify/31520 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2017-2921 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-2921 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-2921 · Aviso do Fabricante