CVE-2020-14934

{"id": "CVE-2020-14934", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2020-08-18T17:15:11.347", "references": [{"url": "https://drive.google.com/file/d/1NIf0Y0S47Lu85uSi29kt9tgSh0jYZYfj/view?usp=sharing", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/contiki-ng/contiki-ng/issues/1352", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Buffer overflows were discovered in Contiki-NG 4.4 through 4.5, in the SNMP agent. The function parsing the received SNMP request does not verify the input message's requested variables against the capacity of the internal SNMP engine buffer. If the number of variables in the request exceeds the allocated buffer, a memory write out of the buffer boundaries occurs. This write operation provides a possibility to overwrite other variables allocated in the .bss section by the application. Because the sender of the frame is in control of the content that will be written beyond the buffer limits, and there is no strict process memory separation, this issue may allow overwriting of sensitive memory areas of an IoT device."}, {"lang": "es", "value": "Se detectaron desbordamientos del b\u00fafer en Contiki-NG versiones 4.4 hasta 4.5, en el agente SNMP. La funci\u00f3n que analiza la petici\u00f3n SNMP recibida no verifica las variables solicitadas del mensaje de entrada contra la capacidad del b\u00fafer interno del motor SNMP. Si el n\u00famero de variables en la petici\u00f3n supera el b\u00fafer asignado, se produce una escritura de la memoria fuera de los l\u00edmites del b\u00fafer. Esta operaci\u00f3n de escritura brinda la posibilidad de sobrescribir otras variables asignadas en la secci\u00f3n .bss por parte de la aplicaci\u00f3n. Debido a que el remitente de la trama tiene el control del contenido que se escribir\u00e1 m\u00e1s all\u00e1 de los l\u00edmites del b\u00fafer y no existe una separaci\u00f3n estricta de la memoria del proceso, este problema puede permitir la sobrescritura de \u00e1reas de memoria confidencial de un dispositivo de IoT."}], "lastModified": "2020-08-25T20:04:49.927", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:contiki-ng:contiki-ng:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "031BDB59-5EDC-4D78-8E74-9432B766A874", "versionEndIncluding": "4.5", "versionStartIncluding": "4.4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}