Fluent Bit up to 1.0.4 MQTT Input Plugin mqtt_prot.c mqtt_packet_drop size input validation

Summaryinfo

A vulnerability marked as critical has been reported in Fluent Bit up to 1.0.4. The affected element is the function mqtt_packet_drop of the file /plugins/in_mqtt/mqtt_prot.c of the component MQTT Input Plugin. Performing a manipulation of the argument size as part of Crafted Packet results in input validation. This vulnerability is cataloged as CVE-2019-9749. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in Fluent Bit up to 1.0.4. This affects the function mqtt_packet_drop of the file /plugins/in_mqtt/mqtt_prot.c of the component MQTT Input Plugin. The manipulation of the argument size as part of a Crafted Packet leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in the MQTT input plugin in Fluent Bit through 1.0.4. When this plugin acts as an MQTT broker (server), it mishandles incoming network messages. After processing a crafted packet, the plugin's mqtt_packet_drop function (in /plugins/in_mqtt/mqtt_prot.c) executes the memmove() function with a negative size parameter. That leads to a crash of the whole Fluent Bit server via a SIGSEGV signal.

The bug was discovered 02/25/2019. The weakness was shared 03/13/2019. This vulnerability is uniquely identified as CVE-2019-9749 since 03/13/2019. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 16 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Fluent Bit

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion