Libnids TCP Reassembly Memory Error May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1008009
|
|
CVE Reference: CAN-2003-0850
(Links to External Site)
|
Date: Oct 27 2003
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 1.17 and prior versions
|
Description: A vulnerability was reported in Libnids. A remote user may be able to execute arbitrary code on the target system, depending on the application using libnids.
It is reported that the code that performs TCP reassembly contains a flaw that may allow remote code execution. An application that
uses libnids TCP reassembly may be affected. The report indicates that, for example, dsniff may be vulnerable.
The vulnerability
is reportedly due to a memory corruption flaw that can be triggered by "overlarge TCP packets."
Robert Watson is credited with
discovering this flaw.
|
Impact: A remote user may be able to cause an application using the Libnids TCP reassembly functions to execute arbitrary code. The specific impact depends on the application using libnids.
|
Solution: The vendor has released a fixed version (1.18), available at:
http://prdownloads.sourceforge.net/libnids/libnids-1.18.tar.gz?download
|
Vendor URL: www.packetfactory.net/projects/libnids/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Linux (Any), UNIX (Any)
|
Reported By: rafal.wojtczuk@7bulls.com (Rafal Wojtczuk)
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Mon, 27 Oct 2003 20:09:55 +0100
From: rafal.wojtczuk@7bulls.com (Rafal Wojtczuk)
Subject: Libnids <= 1.17 buffer overflow
|
Hello,
Libnids is a library which implements the functionality of NIDS
E-component. Libnids provides IP defragmentation, TCP stream reassembly and
port scan detection.
Robert Watson <rwatson@FreeBSD.org> has found a bug in the part of
libnids code responsible for TCP reassembly. The flaw probably allows for
remote code execution. This vulnerability has been assigned a CVE name
CAN-2003-0850.
Applications not using libnids tcp reassembly (like scanlogd) are not
vulnerable; others, like dsniff, are potentially vulnerable.
All libnids versions <= 1.17 are vulnerable. Libnids 1.18, which fixes
this issue, is available at http://libnids.sourceforge.net.
Save yourself,
Nergal
|
|
