The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject invalid UTF-8 strings to disconnect themselves from the broker by sending a topic string which is not valid UTF-8, and so cause a denial of service for the clients.

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA71655 advisory.

  - The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A     malicious client could cause other clients that do reject invalid UTF-8 strings to disconnect themselves     from the broker by sending a topic string which is not valid UTF-8, and so cause a denial of service for     the clients. (CVE-2017-7653)

  - In Eclipse Mosquitto 1.4.15 and earlier, a Memory Leak vulnerability was found within the Mosquitto     Broker. Unauthenticated clients can send crafted CONNECT packets which could cause a denial of service in     the Mosquitto Broker. (CVE-2017-7654)

  - In Eclipse Mosquitto version from 1.0 to 1.4.15, a Null Dereference vulnerability was found in the     Mosquitto library which could lead to crashes for those applications using the library. (CVE-2017-7655)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4023-1 advisory.

    It was discovered that Mosquitto broker incorrectly handled certain specially crafted input and network     packets. A remote attacker could use this to cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that mosquitto, an MQTT broker, was vulnerable to remote denial-of-service attacks that could be mounted using various vectors.

CVE-2017-7653

As invalid UTF-8 strings are not correctly checked, an attacker could cause a denial of service to other clients by disconnecting them from the broker with special crafted topics.

CVE-2017-7654

Due to a memory leak unauthenticated clients can send special crafted CONNECT packets which could cause a denial of service in the broker.

CVE-2017-9868

Due to wrong file permissions local users could obtain topic information from the mosquitto database.

For Debian 8 'Jessie', these problems have been fixed in version 1.3.4-2+deb8u3.

We recommend that you upgrade your mosquitto packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
178191	Juniper Junos OS Multiple Vulnerabilities (JSA71655)	Nessus	Junos Local Security Checks	high
126096	Ubuntu 16.04 LTS / 18.04 LTS : Mosquitto vulnerabilities (USN-4023-1)	Nessus	Ubuntu Local Security Checks	high
118408	Debian DSA-4325-1 : mosquitto - security update	Nessus	Debian Local Security Checks	high
117835	Debian DLA-1525-1 : mosquitto security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2017-7653

medium

Tenable Plugins

high

high

high

medium