Buffer Overflow in NetX Duo mDNS Responder

Executive Summary

This is a heap buffer overflow vulnerability in the mDNS responder of ExpressLogic Azure RTOS NX. An attacker on the local network can send two specially crafted mDNS records with specific name lengths that cause the responder to write past the end of its transmit packet buffer. The issue stems from incorrect handling of name length rounding and stale length values during packet construction.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a heap-buffer-overflow in the mDNS responder due to improper handling of string lengths and slot sizes. Detection requires monitoring for memory corruption or packet corruption in network traffic involving mDNS responses. Check for corrupted packets or pool free list corruption in network logs or memory dumps.

Useful 0 Not Useful 0

Impact Analysis

An attacker could corrupt adjacent network packets or manipulate the memory pool free list, potentially leading to denial of service, information disclosure, or remote code execution. The impact depends on the specific runtime environment and memory allocation patterns of the affected system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker on the local network to corrupt memory by sending specially crafted mDNS records, potentially leading to packet corruption or pool free list corruption. This could disrupt network services or cause unexpected behavior, but does not directly impact data confidentiality or integrity required by standards like GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

Apply patches or updates from the vendor if available. Disable mDNS responder services if not required. Implement network segmentation to limit exposure. Monitor network traffic for unusual mDNS responses or packet corruption.

Useful 0 Not Useful 0