PT-2025-41176 · Nasa · Ion-Dtn+1
Stephanhav
·
Publicado
2025-10-07
·
Atualizado
2025-10-07
·
CVE-2025-61910
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
NASA’s Interplanetary Overlay Network (ION) version 4.1.3
Description
A specially crafted BPv7 bundle with a malformed extension block can lead to a Denial-of-Service (DoS) condition in ION-DTN. The issue stems from uncontrolled memory allocation triggered by processing a byte string within an extension block. Specifically, the vulnerability occurs when parsing the fifth element of a CBOR array within the extension block. The code in
bei.c:764 converts an unsigned integer blockLength to a signed integer blkSize, resulting in a negative value that, when converted to a 64-bit unsigned value, causes an attempt to allocate an unrealistic amount of memory. The triggering bundle contains an extension block starting at 0x85070201005bbb0e20b4ea001a000927c0....Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Ion-Dtn
Interplanetary Overlay Network