PT-2019-14813 · Riot · Riot

Nmeum · Publicado 2019-09-24 · Atualizado 2020-02-18 · CVE-2019-16754

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions RIOT version 2019.07

Description The issue is related to a NULL pointer dereference in the MQTT-SN implementation. An attacker could potentially crash a network node running the affected software by spoofing an MQTT server response. This would require knowledge of the MQTT MsgID of a pending MQTT protocol message, the ephemeral port used by the MQTT implementation, and the server IP address.

Recommendations For RIOT version 2019.07, consider restricting access to the network to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the MQTT-SN implementation in critical applications.

Exploit

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2019-16754

Produtos afetados

Riot

Referências · 3

• 🔥 https://github.com/RIOT-OS/RIOT/pull/12293 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-16754 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-16754 · Aviso do Fabricante