PT-2018-3830 · None+1 · Microjson+2

Published 2018-06-15 · Updated 2021-11-02 · CVE-2018-17937

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions gpsd versions 2.90 to 3.17 microjson versions 1.0 to 1.3

Description The issue is related to a stack-based buffer overflow in gpsd, which may allow remote attackers to execute arbitrary code on embedded platforms. This can be achieved via traffic on Port 2947/TCP or crafted JSON inputs. The exploitation of this issue may also allow an attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For gpsd versions 2.90 to 3.17, consider disabling the service that listens on Port 2947/TCP until a patch is available. For microjson versions 1.0 to 1.3, avoid using crafted JSON inputs in the affected API endpoints until the issue is resolved. As a temporary workaround, consider restricting access to the vulnerable gpsd daemon to minimize the risk of exploitation.

Fix

RCE

Stack Overflow

Memory Corruption

Weakness Enumeration

CWE-121

CWE-787

Related Identifiers

ALT-PU-2019-2994

ALT-PU-2019-3409

BDU:2022-05871

CVE-2018-17937

DLA-1738-1

DLA-2795-1

MGASA-2019-0150

Affected Products

Alt Linux

Gpsd

Microjson

References · 32

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17937 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-17937 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2019-2994 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0150.html · Security Note
• https://osv.dev/vulnerability/CVE-2018-17937 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-2795-1 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2019-3409 · Vendor Advisory
• https://security.gentoo.org/glsa/202009-17 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17937 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-17937 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2795-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0150 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05871 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-17937 · Vendor Advisory