PT-2018-5651 · Insteon+1 · Insteon Hub+1
Publicado
2018-08-23
·
Atualizado
2022-04-19
·
CVE-2017-14452
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Insteon Hub version 1012
Description:
A buffer overflow issue exists in the PubNub message handler for the "control" channel. Specially crafted replies from the PubNub service can cause buffer overflows, overwriting arbitrary data. The
insteon pubnub.channel cc r buffer, which has a size of 16 bytes, can be overflowed using a c r parameter of arbitrary length. An attacker can exploit this by impersonating PubNub and responding to an HTTPS GET request.Recommendations:
For Insteon Hub version 1012, consider restricting access to the PubNub message handler until a patch is available. As a temporary workaround, avoid using the
c r parameter in the affected API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Insteon Hub
Pubnub