A critical pre-authentication heap overflow vulnerability in MOOS core-moos allows remote attackers to execute arbitrary code without requiring user credentials.

This is a heap-based buffer overflow occurring in the MOOSCommPkt packet handling logic. An unauthenticated attacker can exploit this during the HandShake phase by supplying a negative packet length, causing the application to perform an out-of-bounds write to the heap.

Successful exploitation of this vulnerability leads to remote code execution with the privileges of the MOOS service. Given the CVSS score of 9.8, this poses a severe risk to system integrity and confidentiality, potentially allowing attackers to gain full control over the host environment. This vulnerability is particularly dangerous as it requires no prior authentication, facilitating easy exploitation by external actors.

Immediate Action: Update themoos core-moos to the latest patched version available from the vendor repository. If an update is not immediately feasible, restrict network access to the MOOS service to trusted internal segments.

Proactive Monitoring: Monitor network traffic for malformed packets directed at the MOOS service port. Review system logs for signs of process crashes or unauthorized memory access patterns during the authentication handshake.

Compensating Controls: Deploy a network-based intrusion detection system or a firewall configured to drop packets that exhibit anomalous length fields or non-standard handshake sequences associated with MOOS traffic.

Public Exploit Available: Unknown

Due to the critical nature of this heap overflow and the lack of required authentication, all organizations running MOOS core-moos must prioritize patching. Identify all instances of the affected software within the infrastructure and apply the vendor-provided update as a matter of urgency to prevent potential system compromise.