Heap Overflow in MOOS core-moos Pre-Authentication

Executive Summary

MOOS core-moos through 10.4.0 has a pre-authentication heap overflow vulnerability in MOOSCommPkt packet handling. Attackers can exploit a negative packet length to write arbitrary data by bypassing signed integer checks in InflateTo() and negative size conversion in recv(). This overflows a four-byte heap buffer during the HandShake phase before authentication.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for unusual packet handling in MOOS core-moos versions up to 10.4.0. Check for negative packet length declarations or unexpected heap overflows during the HandShake phase. Use network monitoring tools like Wireshark to inspect MOOSCommPkt packets for malformed lengths. On the system, monitor for crashes or memory corruption in the MOOS process.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary code or cause denial-of-service conditions on affected systems. Since it occurs before authentication, attackers can gain unauthorized access without valid credentials, potentially leading to data breaches or system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face fines, legal penalties, and reputational damage due to non-compliance if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update MOOS core-moos to the latest version beyond 10.4.0 to patch the heap overflow. If an update is unavailable, restrict network access to MOOS services using firewalls or disable the HandShake phase if possible. Monitor system logs for signs of exploitation attempts.

Useful 0 Not Useful 0