Misues same epoch number within TCP lifetime in TinyDTLS

[Meng Ruijie <ruijie_meng () u nus edu>]

[Suggested description]
An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30. DTLS servers allow remote attackers to reuse the 
same epoch number within two times the TCP maximum segment lifetime, which is prohibited in RFC6347. This vulnerability 
allows remote attackers to obtain sensitive application (data of connected clients).

[VulnerabilityType Other]
Improper Handling of exception conditions

[Vendor of Product]
https://github.com/contiki-ng/tinydtls

[Affected Product Code Base]
contiki-ng tinydtls - master branch 53a0d97

[Affected Component]
the service of dtls servers

[Attack Type]
Remote

[Impact Code execution]
true

[Impact Information Disclosure]
true

[Reference]
https://github.com/contiki-ng/tinydtls/issues/25

[Discoverer]
jerrytesting

[CVE Reference]
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2021-42146 to this 
vulnerability.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/