PT-2023-4900 · Eprosima+2 · Eprosima Fast Dds+2

Squizz617 · Publicado 2023-08-11 · Atualizado 2023-08-24 · CVE-2023-39948

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions eprosima Fast DDS versions prior to 2.10.0 and 2.6.5

Description The issue is related to insufficient handling of exceptional states in the eprosima Fast DDS library, which is a C++ implementation of the Data Distribution Service standard of the Object Management Group. This can allow a remote attacker to cause a denial of service by crashing any Fast DDS process. The BadParamException thrown by Fast CDR is not caught in Fast DDS, leading to this vulnerability.

Recommendations To resolve the issue, update to version 2.10.0 or 2.6.5, as these versions contain a patch for this issue. As a temporary workaround, consider implementing exception handling for the BadParamException thrown by Fast CDR to prevent remote crashes of Fast DDS processes.

Exploit

Correção

Enumeração de Fraquezas

CWE-248

Identificadores relacionados

BDU:2023-05393

CVE-2023-39948

DSA-5481-1

GHSA-X9PJ-VRGF-F68F

USN-6306-1

Produtos afetados

Linuxmint

Ubuntu

Eprosima Fast Dds

Referências · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39948.json · Exploit
• https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-x9pj-vrgf-f68f · Nota
• https://github.com/eProsima/Fast-DDS/issues/3422 · Nota
• https://github.com/eProsima/Fast-DDS/files/11117197/fastdds-assert.pcap.zip · Nota
• https://rapid7.com/db/vulnerabilities/ubuntu-cve-2023-39948 · Nota
• https://ubuntu.com/security/CVE-2023-39946 · Aviso do Fabricante
• https://twitter.com/cracbot/status/1690241828711526402 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2023-39948 · Aviso do Fabricante
• https://t.me/cibsecurity/68346 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-39948 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2023-39948 · Nota de Segurança
• https://ubuntu.com/security/notices/USN-6306-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-39949 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-39947 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-39948 · Aviso do Fabricante