SB2019072923 - Buffer overflow in Eclipse DTLS server

Description

This security bulletin contains information about 1 vulnerability.

1) Buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-120 - Buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to crash the target server.

The vulnerability exists in the "dtls_update_parameters" function due to a boundary error when the server incorrectly handles incoming network messages. A remote attacker can send a specially crafted request to the affected system, trigger buffer overflow and crash the target server.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://bugs.eclipse.org/bugs/show_bug.cgi?id=544824
• https://github.com/eclipse/tinydtls/commit/494a40dfbb174930ca616e560532d52549736b42