CVE-2019-17389: High severity riot os vulnerability
In RIOT 2019.07, the MQTT-SN implementation (asymcute) mishandles errors occurring during a read operation on a UDP socket. The receive loop ends. This allows an attacker (via a large packet) to prevent a RIOT MQTT-SN client from working until the device is restarted.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-17389?
CVE-2019-17389 is considered to have a medium severity due to potential denial of service caused by large packet attacks.
How do I fix CVE-2019-17389?
To fix CVE-2019-17389, update your RIOT OS to a later version than 2019.07 that addresses the MQTT-SN implementation.
What systems are affected by CVE-2019-17389?
CVE-2019-17389 affects RIOT OS version 2019.07 specifically.
What symptoms indicate an exploit of CVE-2019-17389?
Devices may become unresponsive and require a restart, indicating an exploit of CVE-2019-17389.
Can CVE-2019-17389 be exploited remotely?
Yes, CVE-2019-17389 can be exploited remotely if an attacker sends a large packet to the vulnerable MQTT-SN client.