Description
ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function that allows unauthenticated remote attackers to read memory by sending truncated SDNV values. Attackers can send a UDP datagram to the LTP link service input port with a truncated SDNV to trigger reads up to nine bytes past buffer boundaries and underflow byte counters.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
nasa-jpl ION-DTN
Default version status: unaffected
0 to < 4.2.0affected
References
- https://github.com/nasa-jpl/ION-DTN/security/advisories/GHSA-85pw-28vw-2jf7 ↗
- https://github.com/nasa-jpl/ION-DTN/commit/d52d22bdd383798712357f86a2778757f740e812 ↗
- https://github.com/nasa-jpl/ION-DTN/releases/tag/ion-open-source-4.2.0 ↗
- https://github.com/nasa-jpl/ION-DTN/blob/ion-open-source-4.1.4/ici/library/platform.c#L1982 ↗
- https://github.com/nasa-jpl/ION-DTN/blob/ion-open-source-4.1.4/ici/library/ion.c#L1693 ↗
- https://github.com/nasa-jpl/ION-DTN ↗
- https://www.vulncheck.com/advisories/ion-dtn-before-4.2.0-out-of-bounds-read-via-decodesdnv ↗