[FD] Misues same epoch number within TCP lifetime in TinyDTLS

[Meng Ruijie <ruijie_meng@xxxxxxxxx>]

[Suggested description]
An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30. DTLS servers 
allow remote attackers to reuse the same epoch number within two times the TCP 
maximum segment lifetime, which is prohibited in RFC6347. This vulnerability 
allows remote attackers to obtain sensitive application (data of connected 
clients).

[VulnerabilityType Other]
Improper Handling of exception conditions

[Vendor of Product]
https://github.com/contiki-ng/tinydtls

[Affected Product Code Base]
contiki-ng tinydtls - master branch 53a0d97

[Affected Component]
the service of dtls servers

[Attack Type]
Remote

[Impact Code execution]
true

[Impact Information Disclosure]
true

[Reference]
https://github.com/contiki-ng/tinydtls/issues/25

[Discoverer]
jerrytesting

[CVE Reference]
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned 
the name CVE-2021-42146 to this vulnerability.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/