bvlc.c in skarg BACnet Protocol Stack bacserv 0.9.1 and 0.8.5 is affected by a Buffer Overflow because of a lack of packet-size validation. The affected component is bacserv BACnet/IP BVLC forwarded NPDU. The function bvlc_bdt_forward_npdu() calls bvlc_encode_forwarded_npdu() which copies the content from the request into a local in the bvlc_bdt_forward_npdu() stack frame and clobbers the canary. The attack vector is: A BACnet/IP device with BBMD enabled based on this library connected to IP network. The fixed version is: 0.8.6.
References
Link | Resource |
---|---|
https://sourceforge.net/p/bacnet/bugs/55/ | |
https://sourceforge.net/p/bacnet/code/3168/ | Patch Third Party Advisory |
https://sourceforge.net/p/bacnet/code/3169/ |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2018-04-20T07:00:00
Updated: 2019-10-07T20:26:59
Reserved: 2018-04-20T00:00:00
Link: CVE-2018-10238
JSON object: View
NVD Information
Status : Modified
Published: 2018-04-20T07:29:00.227
Modified: 2019-10-07T21:15:10.893
Link: CVE-2018-10238
JSON object: View
Redhat Information
No data.
CWE