PT-2019-10740 · Cujo · Cujo Smart Firewall

Published 2019-03-21 · Updated 2023-02-03 · CVE-2018-3985

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CUJO Smart Firewall (affected versions not specified)

Description A double free vulnerability exists in the mdnscap binary when parsing mDNS packets. If an invalid query name is encountered, a memory space is freed twice, leading to arbitrary code execution in the context of the mdnscap process. An unauthenticated attacker can send an mDNS message to trigger this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2018-3985

Affected Products

Cujo Smart Firewall

References · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0653 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3985 · Security Note
• https://osv.dev/vulnerability/CVE-2018-3985 · Vendor Advisory