1. CVE-Search
  2. CVE-2017-7185
ID CVE-2017-7185
Summary Use-after-free vulnerability in the mg_http_multipart_wait_for_boundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service (crash) via a multipart/form-data POST request without a MIME boundary string.
References
Vulnerable Configurations
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:3.2:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:3.3:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:3.4:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:3.4:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:3.5:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:3.5:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:3.6:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:3.6:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:3.7:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:3.7:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:3.8:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:3.8:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:4.0:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:4.1:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:5.0:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:5.1:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:5.2:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:5.2:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:5.3:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:5.3:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:5.4:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:5.4:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:5.5:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:5.5:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:5.5_20140120:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:5.5_20140120:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:5.6:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:5.6:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:6.0:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:6.1:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:6.2:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:6.2:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:6.3:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:6.3:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:6.4:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:6.4:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:6.5:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:6.5:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:6.6:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:6.6:*:*:*:*:*:*:*
  • cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:6.7:*:*:*:*:*:*:*
    cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:6.7:*:*:*:*:*:*:*
  • cpe:2.3:o:cesanta:mongoose_os:*:*:*:*:*:*:*:*
    cpe:2.3:o:cesanta:mongoose_os:*:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 09-10-2018 - 20:01)
Impact:
Exploitability:
CWE CWE-416
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:P
refmap via4
bid 97370
bugtraq 20170404 CVE-2017-7185 - Mongoose OS - Use-after-free / Denial of Service
confirm
exploit-db 41826
misc https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CVE-2017-7185_mongoose_os_use_after_free.txt
Last major update 09-10-2018 - 20:01
Published 10-04-2017 - 15:59
Last modified 09-10-2018 - 20:01
Back to Top