Remote code execution in WITTENSTEIN high integrity systems products - CVE-2018-16522

 

Remote code execution in WITTENSTEIN high integrity systems products - CVE-2018-16522

Published: October 19, 2018 / Updated: December 11, 2018


Vulnerability identifier: #VU15434
CSH Severity: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber
CVE-ID: CVE-2018-16522
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
FreeRTOS
OpenRTOS
SafeRTOS
Software vendor:
Amazon Web Services
WITTENSTEIN high integrity systems

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to a flaw within the SOCKETS_SetSockOpt function of the AWS secure sockets module in TCP/IP stack of FreeRTOS. A remote attacker can supply a list of ALPN protocols and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

Remediation

Update the affected software to version 1.3.2.

External links