Memory leak in Eclipse Mosquitto - CVE-2017-7654

Vulnerability identifier: #VU81666

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-7654

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak. A remote attacker can send specially crafted CONNECT packets to force the application to leak memory and perform denial of service attack.

Eclipse Mosquitto
Fedora
Junos OS
Junos OS Evolved
mosquitto

Install updates from vendor's website.

Eclipse Mosquitto - update to 1.5
Junos OS - addressed in versions 19.1R3-S10, 19.2R3-S7, 19.3R3-S8, 19.4R3-S11, 20.2R3-S7, 20.3R3-S6, 20.4R3-S7, 21.1R3-S4, 21.2R3-S5, 21.3R3-S4, 21.4R3-S4, 22.1R3, 22.2R3, 22.3R2, 22.4R1
Junos OS Evolved - addressed in versions 20.4R3-S7-EVO, 21.4R3-S4-EVO, 22.1R3-EVO, 22.2R3-EVO, 22.3R2-EVO, 22.4R1-EVO
mosquitto - update to 1.5.3-1.el7

• https://bugs.eclipse.org/bugs/show_bug.cgi?id=533493
• https://lists.debian.org/debian-lts-announce/2018/09/msg00036.html
• https://usn.ubuntu.com/4023-1/
• https://www.debian.org/security/2018/dsa-4325

• Multiple vulnerabilities in Eclipse Mosquitto
• Junos OS and Junos OS Evolved update for MQTT
• Fedora EPEL 7 update for mosquitto