PT-2019-10750 · Cujo · Cujo Smart Firewall

Published 2019-03-21 · Updated 2023-02-03 · CVE-2018-4011

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions CUJO Smart Firewall version 7003

Description The issue is related to an integer underflow vulnerability in the mdnscap binary. It occurs when parsing SRV records in an mDNS packet, where the RDLENGTH value is handled incorrectly. This leads to an out-of-bounds access, causing the mdnscap process to crash. An unauthenticated attacker can trigger this issue by sending a specially crafted mDNS message.

Recommendations For version 7003, consider disabling the mdnscap binary or restricting its access to mDNS packets until a patch is available. As a temporary workaround, avoid parsing SRV records from untrusted sources to minimize the risk of exploitation.

Exploit

Fix

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2018-4011

Affected Products

Cujo Smart Firewall

References · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0681 · Exploit
• https://osv.dev/vulnerability/CVE-2018-4011 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-4011 · Security Note