PT-2019-14334 · Riot · Riot

Nmeumo · Publicado 2019-08-27 · Atualizado 2020-02-18 · CVE-2019-15702

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions RIOT through 2019.07

Description The issue is related to the TCP implementation in RIOT, where the parser for TCP options does not properly terminate on all inputs. This can lead to a denial-of-service due to an infinite loop when encountering an unknown zero-length option in the sys/net/gnrc/transport layer/tcp/gnrc tcp option.c file.

Recommendations For RIOT through 2019.07, consider applying a patch to fix the infinite loop issue in the TCP options parser to prevent denial-of-service attacks.

Exploit

Correção

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

CVE-2019-15702

Produtos afetados

Riot

Referências · 3

• 🔥 https://github.com/RIOT-OS/RIOT/issues/12086 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-15702 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-15702 · Aviso do Fabricante