PT-2019-4365 · Open Networking Operating System · Onos

Published 2019-07-18 · Updated 2019-07-25 · CVE-2019-1010250

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions ONOS versions 2.0.0 and earlier

Description The issue is related to poor input validation, which can be exploited by a network administrator or an attacker to install unintended flow rules in the switch. The createFlow() and createFlows() functions in FlowWebResource.java, a RESTful service, are affected. The attack vector is network management and connectivity. This can potentially allow an attacker to arbitrarily modify switch settings.

Recommendations For ONOS versions 2.0.0 and earlier, as a temporary workaround, consider disabling the createFlow() and createFlows() functions in FlowWebResource.java until a patch is available. Restrict access to the FlowWebResource.java module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-00086

CVE-2019-1010250

Affected Products

Onos

References · 9

• 🔥 https://drive.google.com/open?id=1HtdRdf88Nv3RNeQJM9fQ6egY5X-tuewD · Exploit
• 🔥 https://drive.google.com/open?id=17RsaP67w6M2xquQjFf2vXhX3dlVKMdC1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010250 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1010250 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00086 · Security Note
• https://vuldb.com/?id.138302 · Note
• https://cxsecurity.com/cveshow/CVE-2019-1010250 · Note
• https://drive.google.com/file/d/1HtdRdf88Nv3RNeQJM9fQ6egY5X-tuewD/view · Note
• https://drive.google.com/file/d/17RsaP67w6M2xquQjFf2vXhX3dlVKMdC1/view · Note