AXSpawn User Login Buffer Overflow Vulnerability
BID:3824
Info
AXSpawn User Login Buffer Overflow Vulnerability
| Bugtraq ID: | 3824 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 06 2002 12:00AM |
| Updated: | Jan 06 2002 12:00AM |
| Credit: | This vulnerability was announced in a Freshmeat Software Update on January 6, 2002. |
| Vulnerable: |
AXSpawn AXSpawn 0.2.4 .1 |
| Not Vulnerable: |
AXSpawn AXSpawn 0.2.4 .1a |
Discussion
AXSpawn User Login Buffer Overflow Vulnerability
AXSpawn is a freely available, open source PAM implementation for AX25 networks. It is maintained by Michael Vogel.
The AXSpawn program does not properly check input length from incoming packets. This could result in a malicious user sending a custom-crafted packet to the authentication mechanism that could result in the overwriting of stack variables. The problem could then be exploited to execute arbitrary code with the privileges of login.
AXSpawn is a freely available, open source PAM implementation for AX25 networks. It is maintained by Michael Vogel.
The AXSpawn program does not properly check input length from incoming packets. This could result in a malicious user sending a custom-crafted packet to the authentication mechanism that could result in the overwriting of stack variables. The problem could then be exploited to execute arbitrary code with the privileges of login.
Exploit / POC
AXSpawn User Login Buffer Overflow Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
AXSpawn User Login Buffer Overflow Vulnerability
Solution:
Fixed version available:
AXSpawn AXSpawn 0.2.4 .1
Solution:
Fixed version available:
AXSpawn AXSpawn 0.2.4 .1
-
AXSpawn axspawn-pam-0.2.1a-dl1bke-eb7gwl-dik342.tar.gz
http://www.dabo.de/software/axspawn-pam-0.2.1a-dl1bke-eb7gwl-dik342.ta r.gz