NVD Vulnerability Detail

CVE-2019-9748

Summary	In tinysvcmdns through 2018-01-16, an mDNS server processing a crafted packet can perform arbitrary data read operations up to 16383 bytes from the start of the buffer. This can lead to a segmentation fault in uncompress_nlabel in mdns.c and a crash of the server (depending on the memory protection of the CPU and the operating system), or disclosure of memory content via error messages or a server response. NOTE: the product's web site states "This project is un-maintained, and has been since 2013. ... There are known vulnerabilities ... You are advised to NOT use this library for any new projects / products."
Publication Date	March 14, 2019, 4:29 a.m.
Registration Date	Jan. 26, 2021, 11:45 a.m.
Last Update	Nov. 21, 2024, 1:52 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:tinysvcmdns_project:tinysvcmdns::::::::			2018-01-16

Related information, measures and tools

No	URL	refsource	タグ
1	https://bitbucket.org/geekman/tinysvcmdns/issues/10/arbitrary-memory-read-while-parsing		Exploit Third Party Advisory
2	https://bitbucket.org/geekman/tinysvcmdns/issues/10/arbitrary-memory-read-while-parsing		Exploit Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-125	境界外読み取り	https://cwe.mitre.org/data/definitions/125.html

JVN Vulnerability Information

tinysvcmdns における境界外読み取りに関する脆弱性

Title	tinysvcmdns における境界外読み取りに関する脆弱性
Summary	tinysvcmdns には、境界外読み取りに関する脆弱性が存在します。
Possible impacts	情報を取得される、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	March 13, 2019, midnight
Registration Date	April 10, 2019, 4:41 p.m.
Last Update	April 10, 2019, 4:41 p.m.

Affected System

tinysvcmdns project

tinysvcmdns 2018/01/16 まで

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-9748	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9748
2	CVE-2019-9748	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9748
National Vulnerability Database (NVD)
3	CVE-2019-9748	https://nvd.nist.gov/vuln/detail/CVE-2019-9748
4	CVE-2019-9748	https://nvd.nist.gov/vuln/detail/CVE-2019-9748

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-125	https://cwe.mitre.org/data/definitions/125.html
2	CWE-125	https://cwe.mitre.org/data/definitions/125.html

ベンダー情報

No	Name	URL
Bitbucket
1	Arbitrary memory read while parsing malicious mDNS queries	https://bitbucket.org/geekman/tinysvcmdns/issues/10/arbitrary-memory-read-while-parsing
2	Arbitrary memory read while parsing malicious mDNS queries	https://bitbucket.org/geekman/tinysvcmdns/issues/10/arbitrary-memory-read-while-parsing

Change Log

No	Changed Details	Date of change
1	[2019年04月10日] 掲載	April 10, 2019, 4:41 p.m.