Memory corruption in Mongoose - CVE-2017-2921
Published: November 2, 2017
Vulnerability identifier: #VU9107
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2017-2921
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Cesanta Software Ltd.
Affected software:
Mongoose
Mongoose
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists in the Websocket protocol implementation due to boundary error. A remote attacker can send a specially crafted websocket packet over network to cause an an integer overflow leading to heap buffer overflow resulting in denial of service and potential remote code execution.
Successful exploitation of the vulnerability may result in system compromise.
The weakness exists in the Websocket protocol implementation due to boundary error. A remote attacker can send a specially crafted websocket packet over network to cause an an integer overflow leading to heap buffer overflow resulting in denial of service and potential remote code execution.
Successful exploitation of the vulnerability may result in system compromise.
How to mitigate CVE-2017-2921
Update to version 6.10.