Vulnerability identifier: #VU19550
Vulnerability risk: Medium
CVSSv3.1: 6.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C]
CVE-ID:
CWE-ID:
CWE-120
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
DTLS server
Universal components / Libraries /
Libraries used by multiple products
Vendor: Eclipse
Description
The vulnerability allows a remote attacker to crash the target server.
The vulnerability exists in the "dtls_create_cookie" function due to a boundary error when the server incorrectly handles incoming network. A remote attacker can send a specially crafted request to the affected system, trigger buffer overflow and crash the target server.
Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versions
DTLS server: All versions
External links
http://bugs.eclipse.org/bugs/show_bug.cgi?id=544819
http://github.com/eclipse/tinydtls/commit/68a1cdaff9e329e13ea59529f1eb61b05632c297
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.