CVE-2017-12087 Memory corruption in Tinysvcmdns
A heap overflow in the tinysvcmdns library allows remote attackers to execute arbitrary code via specially crafted DNS packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-12087?
CVE-2017-12087 is a critical memory corruption vulnerability in geekman Tinysvcmdns, published on 24 Apr 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An exploitable heap overflow vulnerability exists in the tinysvcmdns library version 2016-07-18. A specially crafted packet can make the library overwrite an arbitrary amount of data on the heap with attacker controlled values. An attacker needs send a dns packet to trigger this vulnerability.
Weakness: CWE-119
Which versions are affected by CVE-2017-12087?
It affects 1 product.
Products include Tinysvcmdns Project Tinysvcmdns.
How do I fix CVE-2017-12087?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-12087 being exploited?
There is no known exploitation of CVE-2017-12087 in the wild and no public exploit code.
Other vulnerabilities in geekman Tinysvcmdns
Sources
Also known as DEBIAN-CVE-2017-12087, GHSA-cf6x-64rm-85pr.