wolfSSL 4.0.0 Hello Packet tls13.c DoPreSharedKeys Length Field memory corruption

Summaryinfo

A vulnerability labeled as critical has been found in wolfSSL 4.0.0. Impacted is the function DoPreSharedKeys of the file tls13.c of the component Hello Packet Handler. Such manipulation as part of Length Field leads to memory corruption. This vulnerability is traded as CVE-2019-11873. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in wolfSSL 4.0.0. It has been rated as critical. Affected by this issue is the function DoPreSharedKeys of the file tls13.c of the component Hello Packet Handler. The manipulation as part of a Length Field leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

wolfSSL 4.0.0 has a Buffer Overflow in DoPreSharedKeys in tls13.c when a current identity size is greater than a client identity size. An attacker sends a crafted hello client packet over the network to a TLSv1.3 wolfSSL server. The length fields of the packet: record length, client hello length, total extensions length, PSK extension length, total identity length, and identity length contain their maximum value which is 2^16. The identity data field of the PSK extension of the packet contains the attack data, to be stored in the undefined memory (RAM) of the server. The size of the data is about 65 kB. Possibly the attacker can perform a remote code execution attack.

The weakness was shared 05/23/2019 (Website). The advisory is shared for download at securityfocus.com. This vulnerability is handled as CVE-2019-11873 since 05/10/2019. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• wolfSSL

Version

• 4.0.0

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion