Abstract
Sniffit is a packet sniffer and monitoring tool. A bug in sniffit prior to 0.3.7 has been found. The bug is caused by an incorrect implementation of the functions clean_filename() and clean_string() which causes a stack buffer overflow when parsing a configuration file with "long" paths (more than 20 characters).
The attacker can to create a specially-crafted sniffit configuration file, which is able to bypass all three protection mechanisms:
Non-eXecutable bit NX
Stack Smashing Protector SSP
Address Space Layout Randomisation ASLR
And execute arbitrary code with root privileges (the id of the user that launches the sniffit).
The new issue has been assigned CVE-2014-5439.
The presented PoC successfully exploits the vulnerability.
The attacker can to create a specially-crafted sniffit configuration file, which is able to bypass all three protection mechanisms:
Non-eXecutable bit NX
Stack Smashing Protector SSP
Address Space Layout Randomisation ASLR
And execute arbitrary code with root privileges (the id of the user that launches the sniffit).
The new issue has been assigned CVE-2014-5439.
The presented PoC successfully exploits the vulnerability.
| Original language | English |
|---|---|
| Type | CVE-2014-5439 |
| Publisher | http://hmarco.org |
| Publication status | Published - 2014 |