PT-2019-17425 · Openwave · Openweave-Core

Claudio Bozzato + 1 · Publicado 2019-08-20 · Atualizado 2022-06-27 · CVE-2019-5039

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Openweave-core version 4.0.2

Description A command execution issue exists in the ASN1 certificate writing functionality. It can be triggered by a specially crafted weave certificate, leading to a heap-based buffer overflow and resulting in code execution. An attacker can exploit this by crafting a specific weave certificate.

Recommendations For Openweave-core version 4.0.2, consider disabling the ASN1 certificate writing functionality until a patch is available. Restrict access to the weave certificate processing module to minimize the risk of exploitation.

Exploit

Correção

Memory Corruption

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-787

CWE-122

Identificadores relacionados

CVE-2019-5039

Produtos afetados

Openweave-Core

Referências · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0802 · Exploit
• https://osv.dev/vulnerability/CVE-2019-5039 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5039 · Nota de Segurança