PT-2019-11260 · Riot · Riot-Os

Publicado 2019-02-04 · Atualizado 2021-07-21 · CVE-2019-1000006

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: RIOT-OS versions after commit 7af03ab624db0412c727eed9ab7630a5282e2fd3

Description: The issue is related to a Buffer Overflow in the sock dns implementation of the DNS protocol, which utilizes the RIOT sock API. This can result in remote code execution. The attack is exploitable via network connectivity.

Recommendations: For versions after commit 7af03ab624db0412c727eed9ab7630a5282e2fd3, consider restricting network connectivity to minimize the risk of exploitation until a patch is available. As a temporary workaround, disabling the sock dns implementation may help mitigate the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2019-1000006

Produtos afetados

Riot-Os

Referências · 3

• 🔥 https://github.com/RIOT-OS/RIOT/issues/10739 · Exploit
• https://osv.dev/vulnerability/CVE-2019-1000006 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-1000006 · Nota de Segurança