title: RTI Connext DDS Professional and Connext DDS Secure Incorrect Calculation of Buffer Size
description: RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 not correctly calculate the size when allocating the buffer, which may result in a buffer overflow.
problem types: CWE-131 Incorrect Calculation of Buffer Size
affected:
{
product: Connext DDS Professional
vendor: RTI
versions:
lessThanOrEqual: 6.1.0, status: affected, version: 4.2x, versionType: custom
}
{
product: Connext DDS Secure
vendor: RTI
versions:
lessThanOrEqual: 6.1.0, status: affected, version: 4.2x, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
version: 3.1
]
solutions: RTI recommends users apply the available patches for these issues. A patch is available on the RTI customer portal or by contacting RTI Support. Also, contact RTI Support for mitigations, including how to use RTI DDS Secure to mitigate against the network amplification issue.