PT-2017-15617 · Cesanta · Mongoose

Published 2017-11-07 · Updated 2022-06-13 · CVE-2017-2921

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose version 6.8

Description A memory corruption issue exists in the Websocket protocol implementation. A specially crafted websocket packet can cause an integer overflow, leading to a heap buffer overflow, which may result in denial of service and potential remote code execution. An attacker can trigger this issue by sending a specially crafted websocket packet over the network.

Recommendations For Cesanta Mongoose version 6.8, consider disabling the Websocket protocol implementation until a patch is available. Restrict access to the network to minimize the risk of exploitation. Avoid using the vulnerable Websocket protocol implementation in production environments until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2017-2921

Affected Products

Mongoose

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2017-0428 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2017-2921 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-2921 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2921 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-2921 · Vendor Advisory
• https://t.me/cvenotify/31520 · Telegram Post