CVE-2018-16598 : Security Advisory and Response

A vulnerability has been found in Amazon Web Services (AWS) FreeRTOS versions 1.3.1 and below, as well as FreeRTOS up to version 10.0.1 (including FreeRTOS+TCP). The WITTENSTEIN WHIS Connect middleware TCP/IP component is also affected. The issue lies in the xProcessReceivedUDPPacket and prvParseDNSReply functions, where any DNS response received is accepted without validation against the corresponding DNS request.

Understanding CVE-2018-16598

This CVE identifies a security vulnerability in AWS FreeRTOS and FreeRTOS+TCP that allows for the acceptance of DNS responses without proper validation.

What is CVE-2018-16598?

CVE-2018-16598 is a vulnerability in AWS FreeRTOS versions 1.3.1 and below, FreeRTOS up to version 10.0.1, and the WITTENSTEIN WHIS Connect middleware TCP/IP component. It allows for the acceptance of DNS responses without validation.

The Impact of CVE-2018-16598

The vulnerability could potentially lead to security breaches, unauthorized access, and compromise of systems utilizing the affected versions of FreeRTOS and the TCP/IP component.

Technical Details of CVE-2018-16598

This section provides more in-depth technical details regarding the CVE.

Vulnerability Description

The vulnerability in CVE-2018-16598 allows for the acceptance of any DNS response without proper validation against the corresponding DNS request in specific functions of FreeRTOS and the TCP/IP component.

Affected Systems and Versions

Amazon Web Services (AWS) FreeRTOS versions 1.3.1 and below
FreeRTOS up to version 10.0.1 (including FreeRTOS+TCP)
WITTENSTEIN WHIS Connect middleware TCP/IP component

Exploitation Mechanism

The issue occurs in the xProcessReceivedUDPPacket and prvParseDNSReply functions, where any DNS response received is accepted without validation against the corresponding DNS request.

Mitigation and Prevention

Protecting systems from CVE-2018-16598 involves taking immediate steps and implementing long-term security practices.

Immediate Steps to Take

Update to the latest patched versions of FreeRTOS and the affected TCP/IP component.
Monitor network traffic for any suspicious DNS activities.
Implement network segmentation to limit the impact of potential attacks.

Long-Term Security Practices

Regularly update and patch software components to address known vulnerabilities.
Conduct security audits and penetration testing to identify and mitigate potential weaknesses.
Educate users and administrators on best security practices to prevent exploitation.

Patching and Updates

AWS FreeRTOS: Update to versions beyond 1.3.1.
FreeRTOS: Upgrade to versions higher than 10.0.1.
WITTENSTEIN WHIS Connect middleware: Apply patches or updates provided by the vendor.