Attack Chain

1. Attacker establishes a TCP/IP connection to the target host on the MOOS communication port.
2. Attacker initiates the HandShake phase of the communication protocol.
3. Attacker crafts a malicious packet header containing a negative integer in the packet length field.
4. The victim application receives the malicious packet via the InflateTo() function.
5. The vulnerability in the signed integer check allows the negative length to pass validation.
6. The application performs a heap-based memory allocation based on the unchecked length.
7. The recv() function processes the attacker-supplied data, resulting in a heap overflow of the internal four-byte buffer.
8. Attacker achieves arbitrary memory write, leading to remote code execution or process termination.

Impact

Successful exploitation of this vulnerability allows unauthenticated remote attackers to execute arbitrary code or cause a denial-of-service condition on affected MOOS installations. This affects systems utilizing MOOS core-moos versions 10.4.0 and earlier. Organizations relying on this software for underwater vehicle communication or similar robotics research environments are at high risk if instances are exposed to untrusted networks.

Recommendation

Prioritized, concrete actions:

• Patch core-moos by upgrading to a version exceeding 10.4.0 immediately upon release of vendor updates.
• Until patching is possible, restrict access to MOOS communication ports via host-based firewalls or network access control lists to known trusted endpoints only.
• Monitor network traffic for anomalous packet headers directed toward MOOS services, specifically looking for TCP streams containing negative length identifiers in the handshake phase.