NVD Vulnerability Detail

CVE-2017-7185

Summary	Use-after-free vulnerability in the mg_http_multipart_wait_for_boundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service (crash) via a multipart/form-data POST request without a MIME boundary string.
Publication Date	April 11, 2017, 12:59 a.m.
Registration Date	Jan. 26, 2021, 1:28 p.m.
Last Update	Nov. 21, 2024, 12:31 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:cesanta:mongoose_embedded_web_server_library::::::::		6.7
cpe:2.3:o:cesanta:mongoose_os::::::::		1.2

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/archive/1/540355/100/0/threaded
2	http://www.securityfocus.com/archive/1/540355/100/0/threaded
3	http://www.securityfocus.com/bid/97370	Third Party Advisory VDB Entry
4	http://www.securityfocus.com/bid/97370	Third Party Advisory VDB Entry
5	https://github.com/cesanta/mongoose/commit/b8402ed0733e3f244588b61ad5fedd093e3cf9cc	Patch Third Party Advisory
6	https://github.com/cesanta/mongoose/commit/b8402ed0733e3f244588b61ad5fedd093e3cf9cc	Patch Third Party Advisory
7	https://github.com/cesanta/mongoose-os/commit/042eb437973a202d00589b13d628181c6de5cf5b	Patch Third Party Advisory
8	https://github.com/cesanta/mongoose-os/commit/042eb437973a202d00589b13d628181c6de5cf5b	Patch Third Party Advisory
9	https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CVE-2017-7185_mongoose_os_use_after_free.txt	Exploit Technical Description Third Party Advisory
10	https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CVE-2017-7185_mongoose_os_use_after_free.txt	Exploit Technical Description Third Party Advisory
11	https://www.exploit-db.com/exploits/41826/
12	https://www.exploit-db.com/exploits/41826/

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-416	解放済みメモリの使用	https://cwe.mitre.org/data/definitions/416.html

JVN Vulnerability Information

Cesanta Mongoose Embedded Web Server Library および Mongoose OS の mongoose.c におけるサービス運用妨害 (DoS) の脆弱性

Title	Cesanta Mongoose Embedded Web Server Library および Mongoose OS の mongoose.c におけるサービス運用妨害 (DoS) の脆弱性
Summary	Cesanta Mongoose Embedded Web Server Library および Mongoose OS の mongoose.c の mg_http_multipart_wait_for_boundary 関数には、解放済みメモリの使用 (Use-after-free) により、サービス運用妨害 (クラッシュ) 状態にされる脆弱性が存在します。
Possible impacts	リモートの攻撃者により、MIME 境界文字列を持たない multipart/form-data POST リクエストを介して、サービス運用妨害 (クラッシュ) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 3, 2017, midnight
Registration Date	May 12, 2017, 5:03 p.m.
Last Update	May 12, 2017, 5:03 p.m.

Affected System

Cesanta

Mongoose Embedded Web Server and Networking Library 6.7 およびそれ以前

Mongoose OS 1.2 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-7185	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7185
National Vulnerability Database (NVD)
2	CVE-2017-7185	https://nvd.nist.gov/vuln/detail/CVE-2017-7185

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-416	https://cwe.mitre.org/data/definitions/416.html

ベンダー情報

No	Name	URL
GitHub
1	Fix crash in multipart handling (mongoose)	https://github.com/cesanta/mongoose/commit/b8402ed0733e3f244588b61ad5fedd093e3cf9cc
2	Fix crash in multipart handling (mongoose-os)	https://github.com/cesanta/mongoose-os/commit/042eb437973a202d00589b13d628181c6de5cf5b

Change Log

No	Changed Details	Date of change
0	[2017年05月12日] 掲載	Feb. 17, 2018, 10:37 a.m.