PT-2018-17575 · Ccn-Lite · Ccn-Lite

Mfrey + 1 · Publicado 2018-01-31 · Atualizado 2018-02-21 · CVE-2018-6480

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CCN-lite version 2

Description A type confusion issue was discovered, leading to a memory access violation and a failure of the nonce feature, which is used for loop prevention. The ccnl fwd handleInterest function assumes a specific type for the union member s, but if the type is different, the memory is either uninitialised or points to incorrect data, rendering the nonce check insufficient.

Recommendations For CCN-lite version 2, consider modifying the ccnl fwd handleInterest function to correctly handle different types for the union member s, ensuring that the memory access is valid and the nonce feature functions as intended.

Correção

Incorrect Type Conversion or Cast

Enumeração de Fraquezas

CWE-704

Identificadores relacionados

CVE-2018-6480

Produtos afetados

Ccn-Lite

Referências · 3

• https://github.com/cn-uofbasel/ccn-lite/issues/159 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-6480 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-6480 · Aviso do Fabricante