Heap-based Buffer Overflow in MCPP
Summary
CVE-2019-14274: MCPP 2.7.2 has a heap-based buffer overflow in the do_msg() function in support.c. Affects mcpp versions < 2.7.2-r2. Fixed in 2.7.2-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MCPP is a package used for processing C/C++ source files. It provides a set of utilities for analyzing and manipulating C/C++ code. The package is commonly used in the Alpine Linux distribution, specifically versions 3.8, 3.9, 3.10, and 3.11. The vulnerability, identified as CVE-2019-14274, is a heap-based buffer overflow in the do_msg() function in support.c.
Vulnerability Detail
The heap-based buffer overflow vulnerability in MCPP allows an attacker to overwrite adjacent memory locations, potentially leading to arbitrary code execution or a denial of service (DoS) attack. This vulnerability can be exploited by sending a specially crafted input to the do_msg() function. The impact of this vulnerability is dependent on the context in which MCPP is used, but it has the potential to compromise the integrity and availability of the affected system.
How To Fix
Minimum fixed version
2.7.2-r2
This is the first release that contains the fix.
sudo apk add --upgrade mcppTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the MCPP package to the patched version.
Conclusion
The heap-based buffer overflow vulnerability in MCPP can have severe consequences, including arbitrary code execution or a denial of service attack. It is crucial to update the MCPP package to the patched version to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for mcpp →
FAQ
MCPP is a package used for processing C/C++ source files. It provides utilities for analyzing and manipulating C/C++ code.
The vulnerability allows an attacker to overwrite adjacent memory locations, potentially leading to arbitrary code execution or a denial of service (DoS) attack.
To fix this vulnerability, update the MCPP package to version 2.7.2-r2 or later using the package manager of your Linux distribution.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by updating the MCPP package.
For more information about this vulnerability, you can refer to the CVE-2019-14274 JSON report available at the following source: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-14274.json
References
Related vulnerabilities
Recent vulnerabilities recorded for mcpp.
