PT-2019-4364 · Open Networking Operating System · Onos

Publicado 2019-07-18 · Atualizado 2019-07-24 · CVE-2019-1010249

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions ONOS versions 2.0.0 and earlier

Description The issue is caused by an integer overflow in the createFlow() and createFlows() functions within the FlowWebResource.java file, which is part of the RESTful service. This can allow a network administrator or an attacker to unintentionally install incorrect flow rules in the switch. The attack vector is related to network management and connectivity. Exploitation of this issue may enable an attacker to arbitrarily modify switch settings.

Recommendations For ONOS versions 2.0.0 and earlier, as a temporary workaround, consider disabling the createFlow() and createFlows() functions until a patch is available. Restrict access to the FlowWebResource.java module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

BDU:2020-00085

CVE-2019-1010249

Produtos afetados

Onos

Referências · 8

• 🔥 https://drive.google.com/open?id=1HtdRdf88Nv3RNeQJM9fQ6egY5X-tuewD · Exploit
• 🔥 https://drive.google.com/open?id=1LxmTXZS-FRJQHAzO2JPgDx5SbLNEJHuJ · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010249 · Nota de Segurança
• https://bdu.fstec.ru/vul/2020-00085 · Nota de Segurança
• https://drive.google.com/file/d/1LxmTXZS-FRJQHAzO2JPgDx5SbLNEJHuJ/view · Nota
• https://cxsecurity.com/cveshow/CVE-2019-1010249 · Nota
• https://osv.dev/vulnerability/CVE-2019-1010249 · Aviso do Fabricante
• https://drive.google.com/file/d/1HtdRdf88Nv3RNeQJM9fQ6egY5X-tuewD/view · Nota