5.6.24. Vulnerabilities

5.6.24.1. [Critical] Stack buffer write overflow while parsing malicious license file

An out-of-bounds write on the stack could occur while parsing a malicious license file.

5.6.24.1.1. User Impact without Security

A vulnerability in the Connext application could have resulted in the following:

  • Stack buffer overflow while parsing a malicious license file.

  • Exploitable by overwriting the license file on the file system with a malicious license file.

  • Potential impact on integrity of Connext application.

  • CVSS Base Score: 6.1 MEDIUM

  • CVSS v3.1 Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

5.6.24.1.2. User Impact with Security

Same impact as “User Impact without Security” above.

[RTI Issue ID CORE-14875]

5.6.24.2. [Critical] Stack buffer write overflow while parsing malicious XML types document

An out-of-bounds write on the stack could occur while parsing a malicious XML types document.

5.6.24.2.1. User Impact without Security

A vulnerability in the Core Libraries affected all products that load types via XML, and could have resulted in the following:

  • Stack buffer overflow while parsing a malicious XML types document.

  • Exploitable by changing an XML configuration file on the file system.

  • Potential impact on the integrity of the application(s) using the XML types document.

  • Potential crash in the application.

  • CVSS Base Score: 7.1 HIGH

  • CVSS 3.1 Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

5.6.24.2.2. User Impact with Security

Same impact as “User Impact without Security” above.

[RTI Issue ID CORE-14872]

5.6.24.3. [Critical] Stack buffer write overflow while parsing a malicious XML types document

An out-of-bounds write on the stack could occur while parsing a malicious XML types document.

5.6.24.3.1. User Impact without Security

A vulnerability in the Core Libraries affected all products that load types via XML, and could have resulted in the following:

  • Stack buffer overflow while parsing a malicious XML types document.

  • Exploitable by changing an XML configuration file on the file system.

  • Potential impact on the integrity of the application(s) using the XML types document. Such applications could include RTI Routing Service.

  • Potential crash in the application.

  • In the case of Routing Service, the vulnerability could potentially be triggered through the remote administration command load, but a successful attack would require a malicious XML include file to already exist in the system, so the “Attack Vector” score is still “Local”.

  • CVSS Base Score: 7.1 HIGH

  • CVSS 3.1 Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

5.6.24.3.2. User Impact with Security

Same impact as “User Impact without Security” above.

[RTI Issue ID CORE-14871]