PT-2019-19839 · Tinysvcmdns · Tinysvcmdns

Published 2019-03-13 · Updated 2020-08-24 · CVE-2019-9747

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions tinysvcmdns versions prior to 2018-01-16

Description The issue occurs when a maliciously crafted mDNS packet is received, causing an infinite loop while parsing an mDNS query. This happens when mDNS compressed labels point to each other, leading the uncompress nlabel function to go into an infinite loop, resulting in the mDNS server hanging.

Recommendations For tinysvcmdns versions prior to 2018-01-16, consider disabling the mDNS server functionality until a maintained alternative is implemented, as the project is un-maintained and has known vulnerabilities.

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2019-9747

Affected Products

Tinysvcmdns

References · 3

• 🔥 https://bitbucket.org/geekman/tinysvcmdns/issues/11/denial-of-service-vulnerability-infinite · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-9747 · Security Note
• https://osv.dev/vulnerability/CVE-2019-9747 · Vendor Advisory