PT-2019-11260 · Riot · Riot-Os

Published 2019-02-04 · Updated 2021-07-21 · CVE-2019-1000006

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: RIOT-OS versions after commit 7af03ab624db0412c727eed9ab7630a5282e2fd3

Description: The issue is related to a Buffer Overflow in the sock dns implementation of the DNS protocol, which utilizes the RIOT sock API. This can result in remote code execution. The attack is exploitable via network connectivity.

Recommendations: For versions after commit 7af03ab624db0412c727eed9ab7630a5282e2fd3, consider restricting network connectivity to minimize the risk of exploitation until a patch is available. As a temporary workaround, disabling the sock dns implementation may help mitigate the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-1000006

Affected Products

Riot-Os

References · 3

• 🔥 https://github.com/RIOT-OS/RIOT/issues/10739 · Exploit
• https://osv.dev/vulnerability/CVE-2019-1000006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1000006 · Security Note