libcoap Stack-Based Buffer Overflow Vulnerability in Address Resolution Allowing Denial-of-Service or Potential Remote Code Execution

A stack-based buffer overflow vulnerability has been identified in libcoap versions through 4.3.5, prior to commit 30db3ea. The issue arises in the address resolution process, where attacker-controlled hostname data is copied into a fixed 256-byte stack buffer without adequate bounds checking. This vulnerability can be exploited by remote attackers to cause a crash and possibly achieve remote code execution, depending on compiler options and runtime memory protections. Exploitation requires the proxy logic to be enabled, activating the proxy request handling code path in applications that use libcoap.

Impact

Exploitation of this vulnerability leads to a stack-based buffer overflow, causing a crash and potentially allowing remote code execution, depending on the environment.

Remediation

Users can upgrade to libcoap version 4.3.5 or later to address this vulnerability.