Sign-up

ID

VAR-201903-1225


CVE

CVE-2018-3985


TITLE

CUJO Smart Firewall Double release vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-015147

DESCRIPTION

An exploitable double free vulnerability exists in the mdnscap binary of the CUJO Smart Firewall. When parsing mDNS packets, a memory space is freed twice if an invalid query name is encountered, leading to arbitrary code execution in the context of the mdnscap process. An unauthenticated attacker can send an mDNS message to trigger this vulnerability. CUJO Smart Firewall Contains a double release vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state

Trust: 1.71

sources: NVD: CVE-2018-3985 // JVNDB: JVNDB-2018-015147 // VULHUB: VHN-134016

AFFECTED PRODUCTS

vendor:getcujomodel:smart firewallscope:eqversion:7003

Trust: 1.0

vendor:cujo aimodel:smart firewallscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2018-015147 // NVD: CVE-2018-3985

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-3985
value: CRITICAL

Trust: 1.0

talos-cna@cisco.com: CVE-2018-3985
value: HIGH

Trust: 1.0

NVD: CVE-2018-3985
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201903-636
value: CRITICAL

Trust: 0.6

VULHUB: VHN-134016
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2018-3985
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-134016
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-3985
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

talos-cna@cisco.com: CVE-2018-3985
baseSeverity: HIGH
baseScore: 8.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 3.9
impactScore: 3.7
version: 3.0

Trust: 1.0

NVD: CVE-2018-3985
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-134016 // JVNDB: JVNDB-2018-015147 // CNNVD: CNNVD-201903-636 // NVD: CVE-2018-3985 // NVD: CVE-2018-3985

PROBLEMTYPE DATA

problemtype:CWE-415

Trust: 1.9

sources: VULHUB: VHN-134016 // JVNDB: JVNDB-2018-015147 // NVD: CVE-2018-3985

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201903-636

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201903-636

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-015147

PATCH
title:Top Pageurl:https://www.getcujo.com/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2018-015147

EXTERNAL IDS
db:TALOSid:TALOS-2018-0653
Trust: 2.5
db:NVDid:CVE-2018-3985
Trust: 2.5
db:JVNDBid:JVNDB-2018-015147
Trust: 0.8
db:CNNVDid:CNNVD-201903-636
Trust: 0.7
db:NSFOCUSid:43014
Trust: 0.6
db:VULHUBid:VHN-134016
Trust: 0.1
sources:
            
            
            VULHUB: VHN-134016 // 
            
            
            
            JVNDB: JVNDB-2018-015147 // 
            
            
            
            CNNVD: CNNVD-201903-636 // 
            
            
            
            NVD: CVE-2018-3985

REFERENCES
url:https://talosintelligence.com/vulnerability_reports/talos-2018-0653
Trust: 2.5
url:https://nvd.nist.gov/vuln/detail/cve-2018-3985
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-3985
Trust: 0.8
url:https://www.talosintelligence.com/vulnerability_reports/talos-2018-0653
Trust: 0.6
url:http://www.nsfocus.net/vulndb/43014
Trust: 0.6
sources:
            
            
            VULHUB: VHN-134016 // 
            
            
            
            JVNDB: JVNDB-2018-015147 // 
            
            
            
            CNNVD: CNNVD-201903-636 // 
            
            
            
            NVD: CVE-2018-3985

CREDITS
Claudio Bozzato      ,Discovered by Claudio Bozzato of Cisco Talos.
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-201903-636

SOURCES
db:VULHUBid:VHN-134016
db:JVNDBid:JVNDB-2018-015147
db:CNNVDid:CNNVD-201903-636
db:NVDid:CVE-2018-3985

LAST UPDATE DATE
2024-11-23T22:41:32.261000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-134016date:2023-02-03T00:00:00
db:JVNDBid:JVNDB-2018-015147date:2019-05-07T00:00:00
db:CNNVDid:CNNVD-201903-636date:2022-04-20T00:00:00
db:NVDid:CVE-2018-3985date:2024-11-21T04:06:26.283

SOURCES RELEASE DATE
db:VULHUBid:VHN-134016date:2019-03-21T00:00:00
db:JVNDBid:JVNDB-2018-015147date:2019-05-07T00:00:00
db:CNNVDid:CNNVD-201903-636date:2019-03-19T00:00:00
db:NVDid:CVE-2018-3985date:2019-03-21T16:29:01.627