Vulnerability Description
bvlc.c in skarg BACnet Protocol Stack bacserv 0.9.1 and 0.8.5 is affected by a Buffer Overflow because of a lack of packet-size validation. The affected component is bacserv BACnet/IP BVLC forwarded NPDU. The function bvlc_bdt_forward_npdu() calls bvlc_encode_forwarded_npdu() which copies the content from the request into a local in the bvlc_bdt_forward_npdu() stack frame and clobbers the canary. The attack vector is: A BACnet/IP device with BBMD enabled based on this library connected to IP network. The fixed version is: 0.8.6.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bacnet Protocol Stack Project | Bacnet Protocol Stack | 0.8.5 |
Related Weaknesses (CWE)
References
- https://sourceforge.net/p/bacnet/bugs/55/
- https://sourceforge.net/p/bacnet/code/3168/PatchThird Party Advisory
- https://sourceforge.net/p/bacnet/code/3169/
- https://sourceforge.net/p/bacnet/bugs/55/
- https://sourceforge.net/p/bacnet/code/3168/PatchThird Party Advisory
- https://sourceforge.net/p/bacnet/code/3169/
FAQ
What is CVE-2018-10238?
CVE-2018-10238 is a vulnerability with a CVSS score of 9.8 (CRITICAL). bvlc.c in skarg BACnet Protocol Stack bacserv 0.9.1 and 0.8.5 is affected by a Buffer Overflow because of a lack of packet-size validation. The affected component is bacserv BACnet/IP BVLC forwarded N...
How severe is CVE-2018-10238?
CVE-2018-10238 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2018-10238?
Check the references section above for vendor advisories and patch information. Affected products include: Bacnet Protocol Stack Project Bacnet Protocol Stack.