CVE-2018-3985 Use after free in CUJO
An unauthenticated attacker can achieve arbitrary code execution on the CUJO Smart Firewall by sending a malicious mDNS packet that triggers a double free vulnerability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-3985?
CVE-2018-3985 is a high-severity use after free vulnerability in CUJO, published on 21 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An exploitable double free vulnerability exists in the mdnscap binary of the CUJO Smart Firewall. When parsing mDNS packets, a memory space is freed twice if an invalid query name is encountered, leading to arbitrary code execution in the context of the mdnscap process. An unauthenticated attacker can send an mDNS message to trigger this vulnerability.
Weakness: CWE-415
Which versions are affected by CVE-2018-3985?
It affects 1 product.
Products include Getcujo Smart Firewall.
How do I fix CVE-2018-3985?
No fix has been published for CVE-2018-3985 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2018-3985 being exploited?
There is no known exploitation of CVE-2018-3985 in the wild and no public exploit code.
Other vulnerabilities in CUJO
Sources
Also known as GHSA-x6vq-vc9q-792p.