Buffer Overflow in MOOS Core-MOOS Serial Port

Executive Summary

MOOS core-moos through version 10.4.0 has a buffer overflow in the CMOOSSerialPort::GetTelegram() function. It writes a NUL terminator one byte past a stack buffer used for serial telegrams. Attackers controlling the serial line can send a full-length telegram to trigger this off-by-one write, corrupting the stack and potentially allowing code execution.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the MOOS core-moos software and requires monitoring the serial line for unexpected telegrams. Check for crashes or memory corruption in the MOOS process. Use system logs to detect abnormal behavior in core-moos.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary code on the affected system by sending specially crafted data over the serial line. This could lead to unauthorized access, data theft, or system compromise depending on the privileges of the MOOS application.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to corrupt memory and potentially execute arbitrary code via a serial line input. This could lead to unauthorized data access, modification, or exfiltration, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Update MOOS core-moos to a version beyond 10.4.0. If an update is unavailable, restrict access to the serial line to trusted sources and monitor for unusual telegrams. Disable the affected functionality if not critical.

Useful 0 Not Useful 0