Tildeslash Monit up to 5.25.2 util.c Util_urlDecode POST Parameter memory corruption

Summaryinfo

A vulnerability identified as critical has been detected in Tildeslash Monit up to 5.25.2. This vulnerability affects the function Util_urlDecode of the file util.c. The manipulation as part of POST Parameter leads to memory corruption. This vulnerability is documented as CVE-2019-11455. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Tildeslash Monit up to 5.25.2 and classified as critical. This issue affects the function Util_urlDecode of the file util.c. The manipulation as part of a POST Parameter leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A buffer over-read in Util_urlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker to retrieve the contents of adjacent memory via manipulation of GET or POST parameters. The attacker can also cause a denial of service (application outage).

The bug was discovered 03/04/2019. The weakness was released 04/22/2019 (Website). The advisory is shared at lists.fedoraproject.org. The identification of this vulnerability is CVE-2019-11455 since 04/22/2019. The attack may be initiated remotely. A simple authentication is required for exploitation. Technical details are known, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 49 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 197454 (Ubuntu Security Notification for Monit Vulnerabilities (USN-3971-1)).

Upgrading to version 5.25.3 eliminates this vulnerability.

Entry connected to this vulnerability is available at VDB-133960. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Tildeslash

Name

• Monit

Version

• 5.25.0
• 5.25.1
• 5.25.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion