CVE-2018-4002 Denial of service in CUJO
Unauthenticated attackers can crash the mdnscap process on CUJO Smart Firewalls by sending malicious mDNS packets that cause stack exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-4002?
CVE-2018-4002 is a medium-severity denial of service vulnerability in CUJO, published on 31 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An exploitable denial-of-service vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 7003. When parsing labels in mDNS packets, the firewall unsafely handles label compression pointers, leading to an uncontrolled recursion that eventually exhausts the stack, crashing the mdnscap process. An unauthenticated attacker can send an mDNS message to trigger this vulnerability.
Weakness: CWE-674
Which versions are affected by CVE-2018-4002?
It affects 1 product.
Products include Cujo Smart Firewall Firmware.
How do I fix CVE-2018-4002?
No fix has been published for CVE-2018-4002 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-4002 being exploited?
There is no known exploitation of CVE-2018-4002 in the wild and no public exploit code.
Sources
Also known as GHSA-q2rr-fhp3-v3j2.