Stack-based buffer overflow in microjson and gpsd - CVE-2018-17937
Published: February 15, 2019
Vulnerability identifier: #VU17714
CSH Severity: Medium
CVSS v4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-17937
CWE-ID: CWE-121
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an adjacent attacker to gain elevated privileges on the target system.
The vulnerability exists due to a boundary error when handling malicious input. An adjacent attacker can trigger stack-based buffer overflow and execute arbitrary code via traffic on Port 2947/TCP or crafted JSON inputs.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
microjson
gpsd
Gentoo Linux
Fedora
gpsd
gpsd
Gentoo Linux
Fedora
gpsd
How to mitigate CVE-2018-17937
Update gpsd to version 3.18 or later.
Update microjson to version 1.4.
Update microjson to version 1.4.
microjson - update to 1.4
gpsd - update to 3.18
gpsd - addressed in versions 3.17-6.fc28, 3.17-6.fc29
gpsd - update to 3.18
gpsd - addressed in versions 3.17-6.fc28, 3.17-6.fc29