PT-2018-14637 · Cesanta · Mongoose

Publicado 2018-10-28 · Atualizado 2018-12-07 · CVE-2018-18765

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose version 6.13

Description A memory read issue exists in the MQTT packet-parsing functionality, specifically a heap-based buffer over-read in mg mqtt next subscribe topic(). This can be triggered by a specially crafted MQTT SUBSCRIBE packet, potentially leading to information disclosure and denial of service. An attacker can exploit this by sending a crafted MQTT packet over the network.

Recommendations For Cesanta Mongoose version 6.13, as a temporary workaround, consider restricting access to the mg mqtt next subscribe topic() function until a patch is available. Avoid processing specially crafted MQTT SUBSCRIBE packets in the affected mg mqtt next subscribe topic() function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2018-18765

Produtos afetados

Mongoose

Referências · 9

• 🔥 https://github.com/TiffanyBlue/PoCbyMyself/blob/master/mongoose6.13/mqtt/Cesanta%20Mongoose%20MQTT%20mg_mqtt_next_subscribe_topic%20heap%20buffer%20overflow.md · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-18765 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-18765 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-18765 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-18765 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-18765 · Nota de Segurança
• https://twitter.com/thracky/status/1059472674940993541 · Nota
• https://osv.dev/vulnerability/CVE-2018-18765 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-18765 · Aviso do Fabricante