Eclipse Mosquitto up to 1.4.15 UTF-8 String input validation

Summaryinfo

A vulnerability described as problematic has been identified in Eclipse Mosquitto up to 1.4.15. Impacted is an unknown function of the component UTF-8 Handler. Such manipulation as part of String leads to input validation. This vulnerability is referenced as CVE-2017-7653. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Eclipse Mosquitto up to 1.4.15. It has been rated as problematic. Affected by this issue is an unknown code block of the component UTF-8 Handler. The manipulation as part of a String leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is availability. CVE summarizes:

The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject invalid UTF-8 strings to disconnect themselves from the broker by sending a topic string which is not valid UTF-8, and so cause a denial of service for the clients.

The bug was discovered 06/05/2018. The weakness was published 06/05/2018 (Website). The advisory is available at bugs.eclipse.org. This vulnerability is handled as CVE-2017-7653 since 04/11/2017. The attack may be launched remotely. The requirement for exploitation is a simple authentication. The technical details are unknown and an exploit is not available.

The vulnerability scanner Nessus provides a plugin with the ID 117835 (Debian DLA-1525-1 : mosquitto security update), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Debian Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 176514 (Debian Security Update for mosquitto (DSA 4325-1)).

Upgrading eliminates this vulnerability. A possible mitigation has been published 5 months after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (117835). Similar entries are available at VDB-117068, VDB-117094 and VDB-118971. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Eclipse

Name

• Mosquitto

Version

• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4
• 1.4.5
• 1.4.6
• 1.4.7
• 1.4.8
• 1.4.9
• 1.4.10
• 1.4.11
• 1.4.12
• 1.4.13
• 1.4.14
• 1.4.15

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion