Use-after-free vulnerability in the mg_http_multipart_wait_for_boundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service (crash) via a multipart/form-data POST request without a MIME boundary string.
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
| Link | Tags |
|---|---|
| https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CVE-2017-7185_mongoose_os_use_after_free.txt | exploit third party advisory technical description |
| http://www.securityfocus.com/bid/97370 | vdb entry third party advisory |
| http://www.securityfocus.com/archive/1/540355/100/0/threaded | mailing list |
| https://github.com/cesanta/mongoose-os/commit/042eb437973a202d00589b13d628181c6de5cf5b | third party advisory patch |
| https://github.com/cesanta/mongoose/commit/b8402ed0733e3f244588b61ad5fedd093e3cf9cc | third party advisory patch |
| https://www.exploit-db.com/exploits/41826/ | exploit |