CVE-2018-5410 - OpenCVE

Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device handle to the system driver and send arbitrary input that will trigger the vulnerability. This vulnerability was introduced in the 1.0.0.5000 version update.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

AV:L/AC:L/Au:N/C:C/I:C/A:C

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Dokan Project	Dokan

Configuration 1 [-]

cpe:2.3:a:dokan_project:dokan:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.securityfocus.com/bid/106274
https://cwe.mitre.org/data/definitions/121.html
https://github.com/dokan-dev/dokany/releases/tag/v1.2.1.1000
https://kb.cert.org/vuls/id/741315/
https://www.exploit-db.com/exploits/46155/

History

No history.

MITRE

Status: PUBLISHED

Assigner: certcc

Published: 2019-01-07T14:00:00

Updated: 2024-08-05T05:33:44.211Z

Reserved: 2018-01-12T00:00:00

Link: CVE-2018-5410

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2019-01-07T13:29:00.280

Modified: 2020-09-18T16:50:23.173

Link: CVE-2018-5410

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Open Source File System", "vendor": "Dokan", "versions": [{"lessThan": "1.0.0.5000*", "status": "affected", "version": "1.0.0.5000", "versionType": "custom"}, {"lessThanOrEqual": "1.2.0.1000", "status": "affected", "version": "1.2.0.1000", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Thanks to Parvez Anwar for reporting this vulnerability."}], "datePublic": "2019-01-07T00:00:00", "descriptions": [{"lang": "en", "value": "Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device handle to the system driver and send arbitrary input that will trigger the vulnerability. This vulnerability was introduced in the 1.0.0.5000 version update."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "description": "CWE-121: Stack-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-01-15T10:57:01", "orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc"}, "references": [{"name": "VU#741315", "tags": ["third-party-advisory", "x_refsource_CERT-VN"], "url": "https://kb.cert.org/vuls/id/741315/"}, {"name": "46155", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/46155/"}, {"tags": ["x_refsource_MISC"], "url": "https://cwe.mitre.org/data/definitions/121.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/dokan-dev/dokany/releases/tag/v1.2.1.1000"}, {"name": "106274", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/106274"}], "solutions": [{"lang": "en", "value": "Dokan developers have released a new version, 1.2.1, that fixes this vulnerability by validating the user input."}], "source": {"discovery": "UNKNOWN"}, "title": "Dokan file system driver contains a stack-based buffer overflow", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cert@cert.org", "ID": "CVE-2018-5410", "STATE": "PUBLIC", "TITLE": "Dokan file system driver contains a stack-based buffer overflow"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Open Source File System", "version": {"version_data": [{"affected": ">=", "version_affected": ">=", "version_name": "1.0.0.5000", "version_value": "1.0.0.5000"}, {"affected": "<=", "version_affected": "<=", "version_name": "1.2.0.1000", "version_value": "1.2.0.1000"}]}}]}, "vendor_name": "Dokan"}]}}, "credit": [{"lang": "eng", "value": "Thanks to Parvez Anwar for reporting this vulnerability."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device handle to the system driver and send arbitrary input that will trigger the vulnerability. This vulnerability was introduced in the 1.0.0.5000 version update."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-121: Stack-based Buffer Overflow"}]}]}, "references": {"reference_data": [{"name": "VU#741315", "refsource": "CERT-VN", "url": "https://kb.cert.org/vuls/id/741315/"}, {"name": "46155", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/46155/"}, {"name": "https://cwe.mitre.org/data/definitions/121.html", "refsource": "MISC", "url": "https://cwe.mitre.org/data/definitions/121.html"}, {"name": "https://github.com/dokan-dev/dokany/releases/tag/v1.2.1.1000", "refsource": "CONFIRM", "url": "https://github.com/dokan-dev/dokany/releases/tag/v1.2.1.1000"}, {"name": "106274", "refsource": "BID", "url": "http://www.securityfocus.com/bid/106274"}]}, "solution": [{"lang": "en", "value": "Dokan developers have released a new version, 1.2.1, that fixes this vulnerability by validating the user input."}], "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T05:33:44.211Z"}, "title": "CVE Program Container", "references": [{"name": "VU#741315", "tags": ["third-party-advisory", "x_refsource_CERT-VN", "x_transferred"], "url": "https://kb.cert.org/vuls/id/741315/"}, {"name": "46155", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/46155/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://cwe.mitre.org/data/definitions/121.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/dokan-dev/dokany/releases/tag/v1.2.1.1000"}, {"name": "106274", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/106274"}]}]}, "cveMetadata": {"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "assignerShortName": "certcc", "cveId": "CVE-2018-5410", "datePublished": "2019-01-07T14:00:00", "dateReserved": "2018-01-12T00:00:00", "dateUpdated": "2024-08-05T05:33:44.211Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dokan_project:dokan:*:*:*:*:*:*:*:*", "matchCriteriaId": "EA11C5CE-2221-4DA0-8A90-73C1BF2F7113", "versionEndExcluding": "1.2.0.1000", "versionStartIncluding": "1.0.0.5000", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device handle to the system driver and send arbitrary input that will trigger the vulnerability. This vulnerability was introduced in the 1.0.0.5000 version update."}, {"lang": "es", "value": "Dokan, desde la versi\u00f3n 1.0.0.5000 hasta la 1.2.0.1000, es vulnerable a un desbordamiento de b\u00fafer basado en pila en el controlador dokan1.sys. Un atacante podr\u00eda crear un manejador de dispositivo en el controlador del sistema y enviar entradas arbitrarias que provocar\u00e1n esta vulnerabilidad. Se introdujo esta vulnerabilidad en la actualizaci\u00f3n de la versi\u00f3n 1.0.0.5000."}], "id": "CVE-2018-5410", "lastModified": "2020-09-18T16:50:23.173", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-01-07T13:29:00.280", "references": [{"source": "cret@cert.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/106274"}, {"source": "cret@cert.org", "tags": ["Third Party Advisory"], "url": "https://cwe.mitre.org/data/definitions/121.html"}, {"source": "cret@cert.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/dokan-dev/dokany/releases/tag/v1.2.1.1000"}, {"source": "cret@cert.org", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://kb.cert.org/vuls/id/741315/"}, {"source": "cret@cert.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://www.exploit-db.com/exploits/46155/"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-121"}], "source": "cret@cert.org", "type": "Secondary"}]}