ntop Remote Format String Vulnerability
BID:4225
Info
ntop Remote Format String Vulnerability
| Bugtraq ID: | 4225 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 28 2002 12:00AM |
| Updated: | Feb 28 2002 12:00AM |
| Credit: | Discovered by Peter Suschlik ([email protected]). Security implications published by hologram <[email protected]>. |
| Vulnerable: |
Luca Deri ntop 2.0 |
| Not Vulnerable: | |
Discussion
ntop Remote Format String Vulnerability
ntop is a tool designed to give an overview of network performance and usage, similar to the Unix top command. ntop was designed for Linux, BSD and Unix based systems, although it has also been ported to Windows.
A vulnerability has been reported in some versions of ntop. User supplied data is used in an unsafe manner in printf and syslog calls, leading to a format string vulnerability. Exploitation of this vulnerability may result in the execution of arbitrary code. If ntop is executed with the -w flag, it may be possible to remotely exploit this vulnerability through a malicious HTTP request.
It was also reported that this condition was produced using Netscape with the following web request:
http://target:port/`ls`
This occurred because Netscape was URL encoding the request, which caused the request to be interpreted as a format string by NTop. For example, `ls` is converted to %60ls%60.
Other versions of ntop may share this vulnerability. This has not been confirmed.
ntop is a tool designed to give an overview of network performance and usage, similar to the Unix top command. ntop was designed for Linux, BSD and Unix based systems, although it has also been ported to Windows.
A vulnerability has been reported in some versions of ntop. User supplied data is used in an unsafe manner in printf and syslog calls, leading to a format string vulnerability. Exploitation of this vulnerability may result in the execution of arbitrary code. If ntop is executed with the -w flag, it may be possible to remotely exploit this vulnerability through a malicious HTTP request.
It was also reported that this condition was produced using Netscape with the following web request:
http://target:port/`ls`
This occurred because Netscape was URL encoding the request, which caused the request to be interpreted as a format string by NTop. For example, `ls` is converted to %60ls%60.
Other versions of ntop may share this vulnerability. This has not been confirmed.
Exploit / POC
ntop Remote Format String Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
ntop Remote Format String Vulnerability
Solution:
This issue is fixed in snapshot released of ntop dated later than March 1, 2002. Snapshots are available at:
http://snapshot.ntop.org
Luca Deri ntop 2.0
Solution:
This issue is fixed in snapshot released of ntop dated later than March 1, 2002. Snapshots are available at:
http://snapshot.ntop.org
Luca Deri ntop 2.0
-
Luca Deri ntop-02-03-01.tgz
http://snapshot.ntop.org/tgz/ntop-02-03-01.tgz
References
ntop Remote Format String Vulnerability
References:
References:
- [Ntop-dev] ntop - format string bug in traceEvent (Peter Suschlik ([email protected]))
- ntop - network top (Luca Deri)