No-IP Dynamic Update Client for Linux Remote Buffer Overflow Vulnerability
BID:32344
Info
No-IP Dynamic Update Client for Linux Remote Buffer Overflow Vulnerability
| Bugtraq ID: | 32344 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2008-5297 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 18 2008 12:00AM |
| Updated: | Jan 19 2009 02:02PM |
| Credit: | xenomuta |
| Vulnerable: |
No-IP Dynamic Update Client 2.1.7 No-IP Dynamic Update Client 0 Gentoo Linux Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 |
| Not Vulnerable: |
No-IP Dynamic Update Client 2.1.8 |
Discussion
No-IP Dynamic Update Client for Linux Remote Buffer Overflow Vulnerability
No-IP Dynamic Update Client (DUC) is prone to a stack-based buffer-overflow vulnerability because it fails to adequately bounds-check input messages.
An attacker can exploit this issue by enticing an unsuspecting user into connecting to a malicious server. Successful attacks will allow arbitrary code to run within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
DUC 2.1.7 for Linux is vulnerable; other versions may also be affected.
No-IP Dynamic Update Client (DUC) is prone to a stack-based buffer-overflow vulnerability because it fails to adequately bounds-check input messages.
An attacker can exploit this issue by enticing an unsuspecting user into connecting to a malicious server. Successful attacks will allow arbitrary code to run within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
DUC 2.1.7 for Linux is vulnerable; other versions may also be affected.
Exploit / POC
No-IP Dynamic Update Client for Linux Remote Buffer Overflow Vulnerability
The following exploit code is available:
The following exploit code is available:
Solution / Fix
No-IP Dynamic Update Client for Linux Remote Buffer Overflow Vulnerability
Solution:
The vendor has released DUC 2.1.8, which may address this issue. Symantec has not been able to confirm this information.
Solution:
The vendor has released DUC 2.1.8, which may address this issue. Symantec has not been able to confirm this information.
References
No-IP Dynamic Update Client for Linux Remote Buffer Overflow Vulnerability
References:
References:
- No-IP Home Page (No-IP)