Out-of-bounds read in libmodbus - CVE-2019-14462
Published: August 9, 2019
Vulnerability identifier: #VU20025
CSH Severity: Low
CVSS v4: 2.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-14462
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to potentially sensitive information or perform denial of service attack.
The vulnerability exists due to a boundary condition within MODBUS_FC_WRITE_MULTIPLE_COILS in libmodbus. A local user can submit specially crafted input to the affected aplication, trigger out-of-bounds read error and read contents of memory on the system or perform denial of service attack.
Affected software
libmodbus
Fedora
Ubuntu
libmodbus5 (Ubuntu package)
libmodbus
Fedora
Ubuntu
libmodbus5 (Ubuntu package)
libmodbus
How to mitigate CVE-2019-14462
Install updates from vendor's website.
libmodbus - addressed in versions 3.0.7, 3.1.5
libmodbus5 (Ubuntu package) - update to 3.0.6-2+deb9u1build0.18.04.1
libmodbus - addressed in versions 3.0.8-1.el7, 3.0.8-1.fc29, 3.0.8-1.fc30
libmodbus5 (Ubuntu package) - update to 3.0.6-2+deb9u1build0.18.04.1
libmodbus - addressed in versions 3.0.8-1.el7, 3.0.8-1.fc29, 3.0.8-1.fc30