ION-DTN vulnerabilities

ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability. An unauthenticated remote attacker can crash the ION process by sending a BPv7 bundle with a zero-length payload, causing a failed CHKZERO assertion and process termination with SIGABRT.

ION-DTN before version 4.2.0 contains an out-of-bounds read vulnerability in the decodeSdnv function that allows unauthenticated remote attackers to read memory by sending truncated SDNV values. Attackers can send a UDP datagram to the LTP link service input port with a truncated SDNV to trigger reads up to nine bytes past buffer boundaries and underflow byte counters.

ION-DTN 4.1.3s contains a vulnerability involving uncontrolled memory allocation when processing a BPv7 bundle with a malformed extension block, leading to receiver thread termination and DoS. The issue is due to a conversion of block length from unsigned int to signed int, causing an attempt to allocate an unrealistic amount of memory.