CVE-2019-17210

{"id": "CVE-2019-17210", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2019-11-04T20:15:10.027", "references": [{"url": "https://github.com/ARMmbed/mbed-os/issues/11802", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/ARMmbed/mbed-os/issues/11802", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A denial-of-service issue was discovered in the MQTT library in Arm Mbed OS 2017-11-02. The function readMQTTLenString() is called by the function MQTTDeserialize_publish() to get the length and content of the MQTT topic name. In the function readMQTTLenString(), mqttstring->lenstring.len is a part of user input, which can be manipulated. An attacker can simply change it to a larger value to invalidate the if statement so that the statements inside the if statement are skipped, letting the value of mqttstring->lenstring.data default to zero. Later, curn is accessed, which points to mqttstring->lenstring.data. On an Arm Cortex-M chip, the value at address 0x0 is actually the initialization value for the MSP register. It is highly dependent on the actual firmware. Therefore, the behavior of the program is unpredictable from this time on."}, {"lang": "es", "value": "Se detect\u00f3 un problema de denegaci\u00f3n de servicio en la biblioteca MQTT en Arm Mbed OS en 02-11-2017. La funci\u00f3n MQTTDeserialize_publish() es llamada por la funci\u00f3n readMQTTLenString() para conseguir la longitud y el contenido del nombre del tema MQTT. En la funci\u00f3n readMQTTLenString(), mqttstring-)lenstring.len es una parte de la entrada del usuario, que puede ser manipulada. Un atacante puede simplemente cambiarlo a un valor mas grande para invalidar la sentencia if de manera que las sentencias dentro de la sentencia if sean omitidas, dejando el valor de mqttstring-)lenstring.data predeterminado en cero. M\u00e1s tarde, curn es accedida, la cual apunta a mqttstring-)lenstring.data. En un chip DE Arm Cortex-M, el valor en la direcci\u00f3n 0x0 es realmente el valor de inicializaci\u00f3n para el registro MSP. Este es muy dependiente del firmware actual. Por lo tanto, el comportamiento del programa es impredecible desde este momento."}], "lastModified": "2024-11-21T04:31:51.857", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arm:mbed-mqtt:2017-11-02:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6AF5DAF9-FBAD-417F-8A1C-BB53E0963586"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:arm:mbed-os:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C018C01-0E0A-4DAD-96ED-E9F471AE9E5F"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}