PT-2019-19839 · Tinysvcmdns · Tinysvcmdns

Publicado 2019-03-13 · Atualizado 2020-08-24 · CVE-2019-9747

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions tinysvcmdns versions prior to 2018-01-16

Description The issue occurs when a maliciously crafted mDNS packet is received, causing an infinite loop while parsing an mDNS query. This happens when mDNS compressed labels point to each other, leading the uncompress nlabel function to go into an infinite loop, resulting in the mDNS server hanging.

Recommendations For tinysvcmdns versions prior to 2018-01-16, consider disabling the mDNS server functionality until a maintained alternative is implemented, as the project is un-maintained and has known vulnerabilities.

Exploit

Correção

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

CVE-2019-9747

Produtos afetados

Tinysvcmdns

Referências · 3

• 🔥 https://bitbucket.org/geekman/tinysvcmdns/issues/11/denial-of-service-vulnerability-infinite · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-9747 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-9747 · Aviso do Fabricante