PT-2018-4703 · Eclipse · Mqtt

Peter Sorowka + 1 · Publicado 2018-05-31 · Atualizado 2019-10-09 · CVE-2016-10523

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MQTT versions prior to 3.4.6 MQTT versions 4.0.x prior to 4.0.5

Description The issue allows specifically crafted MQTT packets to crash the application, making a denial of service attack feasible with very little bandwidth. This is achieved through specific sequences of MQTT packets.

Recommendations Update to version 3.4.6 or later for version 3.x. Update to version 4.0.5 or later for version 4.x.

Exploit

Correção

Buffer Overflow

Resource Exhaustion

Enumeração de Fraquezas

CWE-119

CWE-400

Identificadores relacionados

CVE-2016-10523

GHSA-G3R2-65GC-QPQC

Produtos afetados

Mqtt

Referências · 8

• 🔥 https://github.com/mcollina/mosca/issues/393 · Exploit
• 🔥 https://github.com/mqttjs/mqtt-packet/pull/8 · Exploit
• https://npmjs.com/advisories/75 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-10523 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-g3r2-65gc-qpqc · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-10523 · Aviso do Fabricante
• https://nodesecurity.io/advisories/75 · Nota
• https://github.com/advisories/GHSA-g3r2-65gc-qpqc · Nota