tcptrack Command Line Parsing Heap Based Buffer Overflow Vulnerability

Bugtraq ID:	49352
Class:	Boundary Condition Error
CVE:	CVE-2011-2903
Remote:	Yes
Local:	No
Published:	Aug 29 2011 12:00AM
Updated:	Apr 13 2015 10:24PM
Credit:	Patroklos Argyroudis
Vulnerable:	tcptrack tcptrack 1.4.1 tcptrack tcptrack 1.4.0 Gentoo Linux
Not Vulnerable:	tcptrack tcptrack 1.4.2

tcptrack Command Line Parsing Heap Based Buffer Overflow Vulnerability

tcptrack is prone to a heap-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers may leverage this issue to execute arbitrary code in the context of the application which uses tcptrack as a handler. Failed attacks will cause denial-of-service conditions.

Versions prior to tcptrack 1.4.2 are vulnerable.

tcptrack Command Line Parsing Heap Based Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

tcptrack Command Line Parsing Heap Based Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.

tcptrack Command Line Parsing Heap Based Buffer Overflow Vulnerability

References:

• tcptrack Homepage (tcptrack)