Out-of-bounds read in libmodbus - CVE-2019-14463
Published: August 9, 2019
Vulnerability identifier: #VU20026
CSH Severity: Low
CVSS v4: 2.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-14463
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to potentially sensitive information or perform denial of service attack.
The vulnerability exists due to a boundary condition within MODBUS_FC_WRITE_MULTIPLE_REGISTERS in libmodbus. A local user can submit specially crafted input to the affected aplication, trigger out-of-bounds read error and read contents of memory on the system or perform denial of service attack.
Affected software
libmodbus
Fedora
Ubuntu
libmodbus5 (Ubuntu package)
libmodbus
Fedora
Ubuntu
libmodbus5 (Ubuntu package)
libmodbus
How to mitigate CVE-2019-14463
Install updates from vendor's website.
libmodbus - addressed in versions 3.0.7, 3.1.5
libmodbus5 (Ubuntu package) - update to 3.0.6-2+deb9u1build0.18.04.1
libmodbus - addressed in versions 3.0.8-1.el7, 3.0.8-1.fc29, 3.0.8-1.fc30
libmodbus5 (Ubuntu package) - update to 3.0.6-2+deb9u1build0.18.04.1
libmodbus - addressed in versions 3.0.8-1.el7, 3.0.8-1.fc29, 3.0.8-1.fc30