#VU23392 Missing Authentication for Critical Function in Shadowsocks-libev - CVE-2019-5163

Vulnerability identifier: #VU23392

Vulnerability risk: Medium

CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2019-5163

CWE-ID: CWE-306

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Shadowsocks-libev
Server applications / IDS/IPS systems, Firewalls and proxy servers

Vendor: Shadowsocks

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists in the UDPRelay functionality when utilizing a Stream Cipher and a "local_address". A remote attacker can send a specially crafted UDP packets and cause a FATAL error code path and exit.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Shadowsocks-libev: 3.3.2 - 3.3.3

---

External links
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0956

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.