Eclipse Mosquitto up to 2.0.18 SUBACK Packet on_subscribe heap-based overflow

Summaryinfo

A vulnerability was found in Eclipse Mosquitto up to 2.0.18. It has been declared as critical. Affected is the function on_subscribe of the component SUBACK Packet Handler. Such manipulation leads to heap-based overflow. This vulnerability is uniquely identified as CVE-2024-10525. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Eclipse Mosquitto up to 2.0.18. Affected by this issue is the function on_subscribe of the component SUBACK Packet Handler. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. CVE summarizes:

In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients.

The weakness was disclosed by Qingpeng Du as 190. The advisory is shared for download at gitlab.eclipse.org. This vulnerability is handled as CVE-2024-10525 since 10/30/2024. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 216526 (Debian dla-4059 : libmosquitto-dev - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.0.19 eliminates this vulnerability. The upgrade is hosted for download at mosquitto.org.

The vulnerability is also documented in the vulnerability database at Tenable (216526). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Eclipse

Name

• Mosquitto

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9
• 2.0.10
• 2.0.11
• 2.0.12
• 2.0.13
• 2.0.14
• 2.0.15
• 2.0.16
• 2.0.17
• 2.0.18

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion