Ion Dtn
Monthly
Denial of service in NASA-JPL ION-DTN before 4.2.1-a.1 allows unauthenticated remote attackers to crash the ION process by sending a single crafted BPv7 bundle with a zero-length payload block. The `canonicalizePayloadBlock()` function in `bpsec_util.c` forwards `bundle->payload.length` directly to `zco_clone()` without a zero-value guard; when that value is zero, the CHKZERO assertion fails, `sm_Abort()` is invoked, and the process terminates via SIGABRT. Critically, the crash occurs before any HMAC verification, so no credential, key, or prior session state is needed to trigger it.
Out-of-bounds read in ION-DTN's decodeSdnv() function before version 4.2.0 allows unauthenticated remote attackers to trigger reads up to nine bytes past buffer boundaries by sending a UDP datagram with a truncated SDNV to the LTP link service input port. The unbounded design of the original function - which consumed octets until finding one with a clear high-order bit - made it exploitable whenever all bytes in a truncated input retained the high-order bit set, simultaneously causing byte counter underflow. No public exploit has been identified at time of analysis; a vendor-released patch is available as ION-DTN 4.2.0.
Denial of service in NASA-JPL ION-DTN before 4.2.1-a.1 allows unauthenticated remote attackers to crash the ION process by sending a single crafted BPv7 bundle with a zero-length payload block. The `canonicalizePayloadBlock()` function in `bpsec_util.c` forwards `bundle->payload.length` directly to `zco_clone()` without a zero-value guard; when that value is zero, the CHKZERO assertion fails, `sm_Abort()` is invoked, and the process terminates via SIGABRT. Critically, the crash occurs before any HMAC verification, so no credential, key, or prior session state is needed to trigger it.
Out-of-bounds read in ION-DTN's decodeSdnv() function before version 4.2.0 allows unauthenticated remote attackers to trigger reads up to nine bytes past buffer boundaries by sending a UDP datagram with a truncated SDNV to the LTP link service input port. The unbounded design of the original function - which consumed octets until finding one with a clear high-order bit - made it exploitable whenever all bytes in a truncated input retained the high-order bit set, simultaneously causing byte counter underflow. No public exploit has been identified at time of analysis; a vendor-released patch is available as ION-DTN 4.2.0.