Buffer Over-Read in MOOS Core-MOOS

Executive Summary

This vulnerability is a buffer over-read in MOOS core-moos through version 10.4.0. It occurs in the CMOOSCommPkt component during deserialization when a four-byte packet is processed. Attackers can exploit this by connecting to the MOOSDB port via TCP and sending a specially crafted short packet, which causes the system to read memory outside its intended bounds before authentication is required.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for short TCP packets sent to the MOOSDB port. Use tools like tcpdump or Wireshark to capture and analyze packets. Check for connections followed by immediate disconnection or unusual memory access patterns in system logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to read sensitive memory contents from the MOOS system, potentially exposing confidential data or system information. Since the attack occurs before authentication, it may allow unauthorized access to internal memory, leading to information disclosure or further exploitation depending on the exposed data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update MOOS core-moos to the latest version beyond 10.4.0. If an update is unavailable, restrict network access to the MOOSDB port using firewalls or disable the service if not required. Monitor for suspicious activity and apply network segmentation.

Useful 0 Not Useful 0