CVE-2018-16598: Medium severity amazon freertos vulnerability
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. In xProcessReceivedUDPPacket and prvParseDNSReply, any received DNS response is accepted, without confirming it matches a sent DNS request.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-16598?
CVE-2018-16598 is a vulnerability found in Amazon Web Services (AWS) FreeRTOS, up to version 1.3.1 and FreeRTOS up to version 10.0.1, which allows for the acceptance of any DNS response without confirming if it matches a DNS query.
What software versions are affected by CVE-2018-16598?
CVE-2018-16598 affects Amazon Web Services (AWS) FreeRTOS through version 1.3.1 and FreeRTOS up to version 10.0.1.
What is the severity of CVE-2018-16598?
The severity of CVE-2018-16598 is medium, with a severity value of 5.9.
How can I fix CVE-2018-16598?
To fix CVE-2018-16598, it is recommended to update to a version of Amazon Web Services (AWS) FreeRTOS or FreeRTOS that is not affected by the vulnerability.
Where can I find more information about CVE-2018-16598?
More information about CVE-2018-16598 can be found at the following references: [Reference 1](https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details/), [Reference 2](https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-put-wide-range-devices-risk-compromise-smart-homes-critical-infrastructure-systems/), [Reference 3](https://github.com/aws/amazon-freertos/blob/v1.3.2/CHANGELOG.md).