PT-2019-4364 · Open Networking Operating System · Onos

Published 2019-07-18 · Updated 2019-07-24 · CVE-2019-1010249

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions ONOS versions 2.0.0 and earlier

Description The issue is caused by an integer overflow in the createFlow() and createFlows() functions within the FlowWebResource.java file, which is part of the RESTful service. This can allow a network administrator or an attacker to unintentionally install incorrect flow rules in the switch. The attack vector is related to network management and connectivity. Exploitation of this issue may enable an attacker to arbitrarily modify switch settings.

Recommendations For ONOS versions 2.0.0 and earlier, as a temporary workaround, consider disabling the createFlow() and createFlows() functions until a patch is available. Restrict access to the FlowWebResource.java module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2020-00085

CVE-2019-1010249

Affected Products

Onos

References · 8

• 🔥 https://drive.google.com/open?id=1HtdRdf88Nv3RNeQJM9fQ6egY5X-tuewD · Exploit
• 🔥 https://drive.google.com/open?id=1LxmTXZS-FRJQHAzO2JPgDx5SbLNEJHuJ · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010249 · Security Note
• https://bdu.fstec.ru/vul/2020-00085 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1010249 · Vendor Advisory
• https://drive.google.com/file/d/1LxmTXZS-FRJQHAzO2JPgDx5SbLNEJHuJ/view · Note
• https://cxsecurity.com/cveshow/CVE-2019-1010249 · Note
• https://drive.google.com/file/d/1HtdRdf88Nv3RNeQJM9fQ6egY5X-tuewD/view · Note