| Package | Affected versions | Patched versions |
|---|---|---|
| iotivity | ≤ 1.3.1 |
In IoTivity through 1.3.1, the CoAP server interface can be used for Distributed Denial of Service attacks using source IP address spoofing and UDP-based traffic amplification. The reflected traffic is 6 times bigger than spoofed requests. This occurs because the construction of a "4.01 Unauthorized" response is mishandled. NOTE: the vendor states "While this is an interesting attack, there is no plan for maintainer to fix, as we are migrating to IoTivity Lite."
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free