Open Vehicle Monitoring System 3 Buffer Overflow Vulnerability in PCAP Format

A buffer overflow vulnerability has been identified in Open Vehicle Monitoring System 3 (OVMS3) version 3.3.005. The issue arises in the PCAP format parser within 'canformat_pcap.cpp', where the 'phdr.len' field is not properly validated. This lack of validation allows remote attackers to cause a denial-of-service condition or potentially execute arbitrary code by sending crafted PCAP input.

Impact

Exploitation of this vulnerability leads to a stack buffer overflow, which can commonly result in arbitrary code execution or causing a program to crash.

Reproduction

The vulnerability can be reproduced by sending a crafted PCAP file that exploits the improper validation of the 'phdr.len' field. This can be done by manipulating the PCAP input to include a length value that exceeds the buffer capacity, causing a buffer overflow when the parser processes the file.