PT-2018-14637 · Cesanta · Mongoose

Published 2018-10-28 · Updated 2018-12-07 · CVE-2018-18765

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose version 6.13

Description A memory read issue exists in the MQTT packet-parsing functionality, specifically a heap-based buffer over-read in mg mqtt next subscribe topic(). This can be triggered by a specially crafted MQTT SUBSCRIBE packet, potentially leading to information disclosure and denial of service. An attacker can exploit this by sending a crafted MQTT packet over the network.

Recommendations For Cesanta Mongoose version 6.13, as a temporary workaround, consider restricting access to the mg mqtt next subscribe topic() function until a patch is available. Avoid processing specially crafted MQTT SUBSCRIBE packets in the affected mg mqtt next subscribe topic() function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2018-18765

Affected Products

Mongoose

References · 9

• 🔥 https://github.com/TiffanyBlue/PoCbyMyself/blob/master/mongoose6.13/mqtt/Cesanta%20Mongoose%20MQTT%20mg_mqtt_next_subscribe_topic%20heap%20buffer%20overflow.md · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-18765 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18765 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18765 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-18765 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-18765 · Security Note
• https://osv.dev/vulnerability/CVE-2018-18765 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-18765 · Vendor Advisory
• https://twitter.com/thracky/status/1059472674940993541 · Note