CRITICAL🇵🇱 Wersja polska

CVE-2018-19417

CVSS 10.0v3.0pub. 2018-11-21upd. 2024-11-21

An issue was discovered in the MQTT server in Contiki-NG before 4.2. The function parse_publish_vhdr() that parses MQTT PUBLISH messages with a variable length header uses memcpy to input data into a fixed size buffer. The allocated buffer can fit only MQTT_MAX_TOPIC_LENGTH (default 64) bytes, and a length check is missing. This could lead to Remote Code Execution via a stack-smashing attack (overwriting the function return address). Contiki-NG does not separate the MQTT server from other servers and the OS modules, so access to all memory regions is possible.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

  • Contiki Ng

    APP
    Contiki-Ng
    < 4.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2020-27634CRITICAL9.1PL ✓same product

Contiki-Ng: nieprawidłowa losowość TCP ISN umożliwia ataki na sesje sieciowe

CVE-2023-30546CRITICAL9.8PL ✓same product

Off-by-one w bazie Antelope (Contiki-NG) — odczyt poza buforem

CVE-2020-12141CRITICAL9.1PL ✓same product

Out-of-bounds read w stosie SNMP systemu Contiki-NG

CVE-2020-24336CRITICAL9.8PL ✓same product

Buffer overflow w parsowaniu DNS w Contiki i Contiki-NG (NAT64)

CVE-2020-14935CRITICAL9.8PL ✓same product

Buffer overflow w obsłudze SNMP bulk get w Contiki-NG (RCE)