CVE-2019-11455 (published 2019-04-22T16:29Z)

A buffer over-read in Util_urlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker to retrieve the contents of adjacent memory via manipulation of GET or POST parameters. The attacker can also cause a denial of service (application outage).

Severity: MEDIUM
CVSS v2 base score: 5.5 (AV:N/AC:L/Au:S/C:P/I:N/A:P)
CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://bitbucket.org/tildeslash/monit
commit_details: repo_url: https://bitbucket.org/tildeslash/monit
author: tildeslash
author_date: 2019-03-04 15:49:08+01:00
msg: Fixed: Buffer overrun vulnerability in URL decoding. Thanks to Zack Flack for report.
repository: repo_url: https://bitbucket.org/tildeslash/monit
repo_name: visit repo url
description: visit repo url
repo_language: visit repo url
owner: tildeslash
file_changes: filename: CHANGES
change_type: ModificationType.MODIFY
diff: @@ -30,6 +30,8 @@ Fixed: The CPU user/system/wait statistics may show negative value if the system
 Fixed: XSS vulnerabilitty: HTML escape the log file content when viewed via Monit GUI. Thanks for Zack Flack
 for report.
 
+Fixed: Buffer overrun vulnerability in URL decoding. Thanks to Zack Flack for report.
+
 
 Version 5.25.2
 

programming_language: Markdown
filename: util.c
change_type: ModificationType.MODIFY
diff: @@ -234,7 +234,7 @@ static char *is_str_defined(char *s) {
 /**
  * Convert a hex char to a char
  */
-static char x2c(char *hex) {
+static char _x2c(char *hex) {
         register char digit;
         digit = ((hex[0] >= 'A') ? ((hex[0] & 0xdf) - 'A')+10 : (hex[0] - '0'));
         digit *= 16;
@@ -525,7 +525,7 @@ void Util_handleEscapes(char *buf) {
                                                          */
                                                         *(buf + insertpos) = *(buf+editpos);
                                                 } else {
-                                                        *(buf + insertpos) = x2c(&buf[editpos + 3]);
+                                                        *(buf + insertpos) = _x2c(&buf[editpos + 3]);
                                                         editpos += 4;
                                                 }
                                         }
@@ -561,7 +561,7 @@ int Util_handle0Escapes(char *buf) {
                         switch (*(buf + editpos + 1)) {
                                 case '0':
                                         if (*(buf + editpos + 2) == 'x') {
-                                                *(buf + insertpos) = x2c(&buf[editpos+3]);
+                                                *(buf + insertpos) = _x2c(&buf[editpos+3]);
                                                 editpos += 4;
                                         }
                                         break;
@@ -1551,13 +1551,15 @@ char *Util_urlDecode(char *url) {
         if (url && *url) {
                 register int x, y;
                 for (x = 0, y = 0; url[y]; x++, y++) {
-                        if ((url[x] = url[y]) == '+')
+                        if (url[y] == '+') {
                                 url[x] = ' ';
-                        else if (url[x] == '%') {
-                                if (! (url[x + 1] && url[x + 2]))
+                        } else if (url[y] == '%') {
+                                if (! url[y + 1] || ! url[y + 2])
                                         break;
-                                url[x] = x2c(url + y + 1);
+                                url[x] = _x2c(url + y + 1);
                                 y += 2;
+                        } else {
+                                url[x] = url[y];
                         }
                 }
                 url[x] = 0;

programming_language: C