PT-2019-4365 · Open Networking Operating System · Onos

Publicado 2019-07-18 · Atualizado 2019-07-25 · CVE-2019-1010250

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions ONOS versions 2.0.0 and earlier

Description The issue is related to poor input validation, which can be exploited by a network administrator or an attacker to install unintended flow rules in the switch. The createFlow() and createFlows() functions in FlowWebResource.java, a RESTful service, are affected. The attack vector is network management and connectivity. This can potentially allow an attacker to arbitrarily modify switch settings.

Recommendations For ONOS versions 2.0.0 and earlier, as a temporary workaround, consider disabling the createFlow() and createFlows() functions in FlowWebResource.java until a patch is available. Restrict access to the FlowWebResource.java module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2020-00086

CVE-2019-1010250

Produtos afetados

Onos

Referências · 9

• 🔥 https://drive.google.com/open?id=1HtdRdf88Nv3RNeQJM9fQ6egY5X-tuewD · Exploit
• 🔥 https://drive.google.com/open?id=17RsaP67w6M2xquQjFf2vXhX3dlVKMdC1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010250 · Nota de Segurança
• https://vuldb.com/?id.138302 · Nota
• https://osv.dev/vulnerability/CVE-2019-1010250 · Aviso do Fabricante
• https://cxsecurity.com/cveshow/CVE-2019-1010250 · Nota
• https://drive.google.com/file/d/1HtdRdf88Nv3RNeQJM9fQ6egY5X-tuewD/view · Nota
• https://bdu.fstec.ru/vul/2020-00086 · Nota de Segurança
• https://drive.google.com/file/d/17RsaP67w6M2xquQjFf2vXhX3dlVKMdC1/view · Nota