Traceroute-Nanog Hostname Buffer Overflow Vulnerability
BID:6274
Info
Traceroute-Nanog Hostname Buffer Overflow Vulnerability
| Bugtraq ID: | 6274 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2002-1386 |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 28 2002 12:00AM |
| Updated: | Jul 11 2009 07:16PM |
| Credit: | Vulnerability discovery credited to Paul Starzetz <[email protected]>. |
| Vulnerable: |
Ehud Gavron TrACESroute 6.1.1 Ehud Gavron TrACESroute 6.1 Ehud Gavron TrACESroute 6.0 |
| Not Vulnerable: | |
Discussion
Traceroute-Nanog Hostname Buffer Overflow Vulnerability
Traceroute is a tool that is used to track packets in a TCP/IP network to determine the path of network connections. This vulnerability affects the Traceroute-Nanog program, written for Unix and Linux operating systems.
It has been reported that a buffer overflow exists in Traceroute-Nanog. Due to insufficient bounds checking in the Traceroute-Nanog program, a user may execute the program with a hostname of arbitrary length, and cause the overwriting of stack memory within the process. This could result in the execution of attacker-supplied instructions.
Traceroute is a tool that is used to track packets in a TCP/IP network to determine the path of network connections. This vulnerability affects the Traceroute-Nanog program, written for Unix and Linux operating systems.
It has been reported that a buffer overflow exists in Traceroute-Nanog. Due to insufficient bounds checking in the Traceroute-Nanog program, a user may execute the program with a hostname of arbitrary length, and cause the overwriting of stack memory within the process. This could result in the execution of attacker-supplied instructions.
Solution / Fix
Traceroute-Nanog Hostname Buffer Overflow Vulnerability
Solution:
This problem has reportedly been fixed in packages supplied by SuSE in SuSE Security Advisory SuSE-SA:2002:043. This information is unconfirmed.
Fixes available:
Ehud Gavron TrACESroute 6.0
Ehud Gavron TrACESroute 6.1.1
Solution:
This problem has reportedly been fixed in packages supplied by SuSE in SuSE Security Advisory SuSE-SA:2002:043. This information is unconfirmed.
Fixes available:
Ehud Gavron TrACESroute 6.0
-
Debian traceroute-nanog_6.0-2.2_alpha.deb
http://security.debian.org/pool/updates/main/t/traceroute-nanog/tracer oute-nanog_6.0-2.2_alpha.deb -
Debian traceroute-nanog_6.0-2.2_arm.deb
http://security.debian.org/pool/updates/main/t/traceroute-nanog/tracer oute-nanog_6.0-2.2_arm.deb -
Debian traceroute-nanog_6.0-2.2_i386.deb
http://security.debian.org/pool/updates/main/t/traceroute-nanog/tracer oute-nanog_6.0-2.2_i386.deb -
Debian traceroute-nanog_6.0-2.2_m68k.deb
http://security.debian.org/pool/updates/main/t/traceroute-nanog/tracer oute-nanog_6.0-2.2_m68k.deb -
Debian traceroute-nanog_6.0-2.2_powerpc.deb
http://security.debian.org/pool/updates/main/t/traceroute-nanog/tracer oute-nanog_6.0-2.2_powerpc.deb -
Debian traceroute-nanog_6.0-2.2_sparc.deb
http://security.debian.org/pool/updates/main/t/traceroute-nanog/tracer oute-nanog_6.0-2.2_sparc.deb -
SuSE nkitb-2002.11.6-0.alpha.rpm
ftp://ftp.suse.com/pub/suse/axp/update/7.0/a1/nkitb-2002.11.6-0.alpha. rpm -
SuSE nkitb-2002.11.6-0.i386.rpm
ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/nkitb-2002.11.6-0.i386. rpm -
SuSE nkitb-2002.11.6-0.ppc.rpm
ftp://ftp.suse.com/pub/suse/ppc/update/7.0/a1/nkitb-2002.11.6-0.ppc.rp m -
SuSE traceroute-6.0-0.alpha.rpm
ftp://ftp.suse.com/pub/suse/axp/update/7.1/n1/traceroute-6.0-0.alpha.r pm -
SuSE traceroute-6.0-0.i386.rpm
ftp://ftp.suse.com/pub/suse/i386/update/7.1/n1/traceroute-6.0-0.i386.r pm -
SuSE traceroute-6.0-0.ppc.rpm
ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n1/traceroute-6.0-0.ppc.rpm
Ehud Gavron TrACESroute 6.1.1
-
Debian traceroute-nanog_6.1.1-1.2_alpha.deb
http://security.debian.org/pool/updates/main/t/traceroute-nanog/tracer oute-nanog_6.1.1-1.2_alpha.deb -
Debian traceroute-nanog_6.1.1-1.2_arm.deb
http://security.debian.org/pool/updates/main/t/traceroute-nanog/tracer oute-nanog_6.1.1-1.2_arm.deb -
Debian traceroute-nanog_6.1.1-1.2_hppa.deb
http://security.debian.org/pool/updates/main/t/traceroute-nanog/tracer oute-nanog_6.1.1-1.2_hppa.deb -
Debian traceroute-nanog_6.1.1-1.2_i386.deb
http://security.debian.org/pool/updates/main/t/traceroute-nanog/tracer oute-nanog_6.1.1-1.2_i386.deb -
Debian traceroute-nanog_6.1.1-1.2_ia64.deb
http://security.debian.org/pool/updates/main/t/traceroute-nanog/tracer oute-nanog_6.1.1-1.2_ia64.deb -
Debian traceroute-nanog_6.1.1-1.2_m68k.deb
http://security.debian.org/pool/updates/main/t/traceroute-nanog/tracer oute-nanog_6.1.1-1.2_m68k.deb -
Debian traceroute-nanog_6.1.1-1.2_mips.deb
http://security.debian.org/pool/updates/main/t/traceroute-nanog/tracer oute-nanog_6.1.1-1.2_mips.deb -
Debian traceroute-nanog_6.1.1-1.2_mipsel.deb
http://security.debian.org/pool/updates/main/t/traceroute-nanog/tracer oute-nanog_6.1.1-1.2_mipsel.deb -
Debian traceroute-nanog_6.1.1-1.2_powerpc.deb
http://security.debian.org/pool/updates/main/t/traceroute-nanog/tracer oute-nanog_6.1.1-1.2_powerpc.deb -
Debian traceroute-nanog_6.1.1-1.2_s390.deb
http://security.debian.org/pool/updates/main/t/traceroute-nanog/tracer oute-nanog_6.1.1-1.2_s390.deb -
Debian traceroute-nanog_6.1.1-1.2_sparc.deb
http://security.debian.org/pool/updates/main/t/traceroute-nanog/tracer oute-nanog_6.1.1-1.2_sparc.deb -
SuSE traceroute-6.1.1-0.i386.rpm
ftp://ftp.suse.com/pub/suse/i386/update/7.2/n1/traceroute-6.1.1-0.i386 .rpm -
SuSE traceroute-6.1.1-0.i386.rpm
ftp://ftp.suse.com/pub/suse/i386/update/7.3/n1/traceroute-6.1.1-0.i386 .rpm -
SuSE traceroute-6.1.1-0.i386.rpm
ftp://ftp.suse.com/pub/suse/i386/update/8.0/n1/traceroute-6.1.1-0.i386 .rpm -
SuSE traceroute-6.1.1-0.ppc.rpm
ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n1/traceroute-6.1.1-0.ppc.r pm -
SuSE traceroute-6.1.1-0.sparc.rpm
ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n1/traceroute-6.1.1-0.spa rc.rpm