Poor Input Validation in Linux Foundation ONOS Network Management Software
CVE-2019-1010252

4.9MEDIUM

Key Information:

Vendor

Linux
Status
Onos
Vendor
CVE Published:
18 July 2019

What is CVE-2019-1010252?

The ONOS network management software, specifically versions 2.0.0 and earlier, is affected by poor input validation. This vulnerability allows a network administrator or an attacker to inadvertently install unintended flow rules within the network switch. The issue originates from the applyFlowRules() and apply() functions in FlowRuleManager.java. The potential attack vector highlights the need for robust input validation mechanisms in network management and connectivity applications.

Affected Version(s)

ONOS 2.0.0 and earlier

References

https://drive.google.com/open?id=1HtdRdf88Nv3RNeQJM9fQ6eg...
x_refsource_MISC
https://drive.google.com/open?id=1ce1uqcJYI-sEENGbPmmw-uJ...
x_refsource_MISC

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.