SHAREit up to 4.0.6.177 Message Length Packet resource consumption

Summaryinfo

A vulnerability classified as critical was found in SHAREit up to 4.0.6.177. This affects an unknown part of the component Message Length Handler. Executing a manipulation as part of Packet can lead to resource consumption. This vulnerability is registered as CVE-2019-15234. It is possible to launch the attack remotely. Furthermore, an exploit is available.

Detailsinfo

A vulnerability was found in SHAREit up to 4.0.6.177. It has been declared as critical. This vulnerability affects an unknown function of the component Message Length Handler. The manipulation as part of a Packet leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. CVE summarizes:

SHAREit through 4.0.6.177 does not check the full message length from the received packet header (which is used to allocate memory for the next set of data). This could lead to a system denial of service due to uncontrolled memory allocation. This is different from CVE-2019-14941.

The weakness was published 04/27/2020. This vulnerability was named CVE-2019-15234 since 08/19/2019. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

A public exploit has been developed in Python and been published even before and not after the advisory. It is possible to download the exploit at github.com. It is declared as functional. The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entry is available at VDB-154419. Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• SHAREit

Version

• 4.0.6.177

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #168: ShareIt 4.0.6.177 (Windows) - Uncontrolled Memory Allocation on SecureChannel (by nathunandwani)
• Submit #169: Uncontrolled Memory Allocation on ShareIt 4.0.6.177 for Windows (by nathunandwani)

Once again VulDB remains the best source for vulnerability data.

Discussion