PT-2018-17835 · Ccn-Lite · Ccn-Lite

Blacksheeep · Published 2018-02-13 · Updated 2018-03-16 · CVE-2018-6948

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CCN-lite version 2

Description The issue arises in the ccnl prefix to str detailed function, which can cause a buffer overflow when writing a prefix to the buffer buf. The buffer size is defined as CCNL MAX PREFIX SIZE, but when NFN is enabled, additional characters such as "NFN" and "R2C" tags are written to the buffer, potentially causing an overflow. This can occur when sending an NFN-R2C packet with a prefix of size CCNL MAX PREFIX SIZE.

Recommendations For CCN-lite version 2, consider disabling NFN support to prevent the buffer overflow in the ccnl prefix to str detailed function until a patch is available. Restrict access to the ccnl prefix to str detailed function to minimize the risk of exploitation. Avoid using the buf buffer with NFN-R2C packets that have a prefix of size CCNL MAX PREFIX SIZE until the issue is resolved.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2018-6948

Affected Products

Ccn-Lite

References · 3

• https://osv.dev/vulnerability/CVE-2018-6948 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6948 · Security Note
• https://github.com/cn-uofbasel/ccn-lite/issues/193 · Note