A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side configuration, in conjunction with the affected authentication mechanism, can cause the driver to write outside the bounds of the allocated buffer. This may result in corruption of client process memory and denial of service of the client application.
The issue affects only client builds compiled with the Windows-native authentication backend.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
High
Difficult to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
High
Admin privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
mongodb:c driver
References 4
https://github.com/mongodb/mongo-c-driver/releases/tag/1.30.14
cna@mongodb.com
https://github.com/mongodb/mongo-c-driver/releases/tag/2.5.7
cna@mongodb.com
https://jira.mongodb.org/browse/CDRIVER-6421
cna@mongodb.com
https://github.com/mongodb/mongo-c-driver/security/advisories/GHSA-g9mw-2cwh-6h…
NVD