CVE-2019-14431

In MatrixSSL 3.8.3 Open through 4.2.1 Open, the DTLS server mishandles incoming network messages leading to a heap-based buffer overflow of up to 256 bytes and possible Remote Code Execution in parseSSLHandshake in sslDecode.c. During processing of a crafted packet, the server mishandles the fragment length value provided in the DTLS message.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/matrixssl/matrixssl/issues/30	Exploit Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:matrixssl:matrixssl:*:*:*:*:*:*:*:*

History

03 Mar 2023, 02:46

Type	Values Removed	Values Added
References	~~(MISC) https://github.com/matrixssl/matrixssl/issues/30 - Exploit, Third Party Advisory~~	(MISC) https://github.com/matrixssl/matrixssl/issues/30 - Exploit, Issue Tracking, Third Party Advisory

Information

Published : 2019-07-29 22:15

Updated : 2023-12-10 12:59

NVD link : CVE-2019-14431

Mitre link : CVE-2019-14431

CVE.ORG link : CVE-2019-14431

JSON object : View

Products Affected

matrixssl

matrixssl

CWE

CWE-755

Improper Handling of Exceptional Conditions

CWE-787

Out-of-bounds Write

{"id": "CVE-2019-14431", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-07-29T22:15:12.177", "references": [{"url": "https://github.com/matrixssl/matrixssl/issues/30", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-755"}, {"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "In MatrixSSL 3.8.3 Open through 4.2.1 Open, the DTLS server mishandles incoming network messages leading to a heap-based buffer overflow of up to 256 bytes and possible Remote Code Execution in parseSSLHandshake in sslDecode.c. During processing of a crafted packet, the server mishandles the fragment length value provided in the DTLS message."}, {"lang": "es", "value": "En MatrixSSL versiones 3.8.3 Open hasta 4.2.1 Open, el servidor DTLS maneja inapropiadamente los mensajes de red entrantes que conllevan a un desbordamiento del b\u00fafer en la regi\u00f3n heap de la memoria de hasta 256 bytes y la posible ejecuci\u00f3n de c\u00f3digo remota en la funci\u00f3n parseSSLHandshake en el archivo sslDecode.c. Durante el procesamiento de un paquete dise\u00f1ado, el servidor maneja inapropiadamente el valor de longitud del fragmento proporcionado en el mensaje DTLS."}], "lastModified": "2023-03-03T02:46:39.910", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:matrixssl:matrixssl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5AF92EA-CD0F-49B6-A63A-D1E1E0075D9A", "versionEndIncluding": "4.2.1", "versionStartIncluding": "3.8.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}