CVE-2019-16754

RIOT 2019.07 contains a NULL pointer dereference in the MQTT-SN implementation (asymcute), potentially allowing an attacker to crash a network node running RIOT. This requires spoofing an MQTT server response. To do so, the attacker needs to know the MQTT MsgID of a pending MQTT protocol message and the ephemeral port used by RIOT's MQTT implementation. Additionally, the server IP address is required for spoofing the packet.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://github.com/RIOT-OS/RIOT/pull/12293	Exploit Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:riot-os:riot:2019.07:-:*:*:*:*:*:*

History

No history.

Information

Published : 2019-09-24 18:15

Updated : 2024-02-28 17:28

NVD link : CVE-2019-16754

Mitre link : CVE-2019-16754

CVE.ORG link : CVE-2019-16754

JSON object : View

Products Affected

riot-os

riot

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2019-16754", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2019-09-24T18:15:11.110", "references": [{"url": "https://github.com/RIOT-OS/RIOT/pull/12293", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "RIOT 2019.07 contains a NULL pointer dereference in the MQTT-SN implementation (asymcute), potentially allowing an attacker to crash a network node running RIOT. This requires spoofing an MQTT server response. To do so, the attacker needs to know the MQTT MsgID of a pending MQTT protocol message and the ephemeral port used by RIOT's MQTT implementation. Additionally, the server IP address is required for spoofing the packet."}, {"lang": "es", "value": "RIOT versi\u00f3n 2019.07, contiene una desreferencia del puntero NULL en la implementaci\u00f3n MQTT-SN (asymcute), lo que permite potencialmente a un atacante bloquear un nodo de red que ejecuta RIOT. Esto requiere falsificar una respuesta del servidor MQTT. Para hacerlo, el atacante necesita conocer el MsgID de MQTT de un mensaje de protocolo MQTT pendiente y el puerto ef\u00edmero utilizado por la implementaci\u00f3n MQTT de RIOT. Adicionalmente, es requerida la direcci\u00f3n IP del servidor para suplantar el paquete."}], "lastModified": "2020-02-18T21:29:15.070", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:riot-os:riot:2019.07:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13D3B402-D868-432B-9297-C50651631072"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}