A vulnerability, which was classified as problematic, has been found in Sandstorm Cap'n Proto up to 0.4.1.0/0.5.1.0. Affected by this issue is an unknown function of the component Element Handler. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. CVE summarizes:

Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service (CPU and possibly general resource consumption) via a list with a large number of elements.

The bug was discovered 03/17/2015. The weakness was published 08/09/2017 (oss-sec). The advisory is shared for download at openwall.com. This vulnerability is handled as CVE-2015-2312 since 03/17/2015. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability was handled as a non-public zero-day exploit for at least 876 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 0.4.1.1 or 0.5.1.1 eliminates this vulnerability.

Productinfo

Vendor

• Sandstorm

Name

• Cap'n Proto

Version

• 0.4.0
• 0.4.1
• 0.5.0
• 0.5.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion