Libnemesi Multiple Remote Buffer Overflow Vulnerabilities

Bugtraq ID:	27048
Class:	Boundary Condition Error
CVE:	CVE-2007-6631
Remote:	Yes
Local:	No
Published:	Dec 27 2007 12:00AM
Updated:	May 07 2015 05:34PM
Credit:	Luigi Auriemma is credited with the discovery of these issues.
Vulnerable:	Politecnico di Torino Libnemesi 0.6.4-rc1
Not Vulnerable:	Politecnico di Torino Libnemesi 0.6.4-rc2

Libnemesi Multiple Remote Buffer Overflow Vulnerabilities

Libnemesi is prone to multiple buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied input.

Attackers can exploit these issues to execute arbitrary code in the context of applications that use the library. Failed attacks will cause denial-of-service conditions.

Libnemesi 0.6.4-rc1 is vulnerable; other versions may also be affected.

Libnemesi Multiple Remote Buffer Overflow Vulnerabilities

The following proof-of-concept code is available:

• /data/vulnerabilities/exploits/27048.zip

Libnemesi Multiple Remote Buffer Overflow Vulnerabilities

Solution:
The vendor has released an update to address these issues. Please see the references for more information.


Politecnico di Torino Libnemesi 0.6.4-rc1

• Politecnico di Torino libnemesi-0.6.4-rc2.tar.bz2
  http://live.polito.it/files/downloads/libnemesi/libnemesi-0.6.4-rc2.ta r.bz2

Libnemesi Multiple Remote Buffer Overflow Vulnerabilities

References:

• Libnemesi Homepage (Politecnico di Torino)
  
• Multiple vulnerabilities in libnemesi 0.6.4-rc1 (Luigi Auriemma )