CVE-2018-3985 : What You Need to Know

A possible vulnerability in the mdnscap binary of the CUJO Smart Firewall allows for the exploitation of a double free issue, potentially leading to arbitrary code execution.

Understanding CVE-2018-3985

What is CVE-2018-3985?

An exploitable double free vulnerability exists in the mdnscap binary of the CUJO Smart Firewall. When processing mDNS packets, a memory space is freed twice upon encountering an invalid query name, enabling arbitrary code execution within the mdnscap process by an unauthenticated attacker.

The Impact of CVE-2018-3985

The vulnerability has a CVSS base score of 8.3, indicating a high severity issue. It can be exploited remotely with low attack complexity, potentially allowing attackers to execute arbitrary code.

Technical Details of CVE-2018-3985

Vulnerability Description

The vulnerability lies in the mdnscap binary of the CUJO Smart Firewall, triggered by parsing mDNS packets with an invalid query name.
This leads to a double free issue, enabling arbitrary code execution within the mdnscap process.

Affected Systems and Versions

Product: CUJO
Version: CUJO Smart Firewall - Firmware version 7003

Exploitation Mechanism

An unauthenticated attacker can exploit the vulnerability by sending a malicious mDNS message to trigger the double free issue.

Mitigation and Prevention

Immediate Steps to Take

Update CUJO Smart Firewall to a patched version that addresses the double free vulnerability.
Monitor network traffic for any suspicious mDNS packets.

Long-Term Security Practices

Regularly update firmware and security patches for CUJO devices.
Implement network segmentation to limit the impact of potential attacks.

Patching and Updates

Stay informed about security advisories from CUJO and apply patches promptly to mitigate known vulnerabilities.