Ethereal RADIUS Attribute Parsing Null Pointer Dereference Lets Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1009558
|
|
CVE Reference: CAN-2004-0365
(Links to External Site)
|
Date: Mar 26 2004
|
Impact: Denial of service via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 0.8.13 - 0.10.2
|
Description: A vulnerability was reported in Ethereal in the processing of RADIUS packet attributes. A remote user can cause the Ethereal process to crash.
Jonathan Heusser reported that a remote user can send a specially crafted packet to trigger a null pointer dereference, causing the
application to crash. The flaw reportedly resides in the dissect_attribute_value_pairs() function in the 'packet-radius.c' file.
The
report indicates that it may be possible to execute arbitrary code.
|
Impact: A remote user can cause the application to crash.
|
Solution: The vendor has released a fixed version (0.10.3), available at:
http://www.ethereal.com/download.html
The vendor's advisory is available at:
http://www.ethereal.com/appnotes/enpa-sa-00013.html
|
Vendor URL: www.ethereal.com/appnotes/enpa-sa-00013.html (Links to External Site)
|
Cause: Boundary error, State error
|
Underlying OS: Linux (Any), UNIX (Any)
|
Reported By: jonny@drugphish.ch (Jonathan Heusser)
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Fri, 19 Mar 2004 01:07:09 +0800 (CST)
From: jonny@drugphish.ch (Jonathan Heusser)
Subject: [Ethereal-dev] ethereal radius dissector vulnerability
|
Hello,
during an audit I found a vulnerability in the radius dissector of
ethereal version 0.10.2
(and probably prior to aswell).
This bug allows a remote attacker to cause at least a denial of service
attack. The execution of
arbitrary code could be possible..
The problem is located in the function dissect_attribute_value_pairs of
packet-radius.c:
If you manage to create a packet which causes the find_radius_attr_info
call on line 2600 to return NULL,
and at the same time having avph.avp_length set to 2, then ethereal will
fail while
calling proto_tree_add_text on line 2608. More precisely while accessing
attr_info->str.
...
(2600) attr_info = find_radius_attr_info(avph.avp_type, radius_attrib);
if (avph.avp_length < 2) {
if (tree) {
(2608) proto_tree_add_text(tree, tvb, offset, avph.avp_length,
"t:%s(%u) l:%u (length not >= 2)",
attr_info->str, avph.avp_type, avph.avp_length);
}
...
A possible fix for this would be to bail out when find_radius_attr_info
returns NULL, though this might
not be the best solution.
Thank you,
Jonathan Heusser
--
Key fingerprint = 2A55 EB7C B7EA 6336 7767 4A47 910A 307B 1333 BD6C
_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@ethereal.com
http://www.ethereal.com/mailman/listinfo/ethereal-dev
|
|
