CVE-2014-5439 - root shell on sniffit

Ismael Ripoll, Hector Marco

Research output: Other contribution


Sniffit is a packet sniffer and monitoring tool. A bug in sniffit prior to 0.3.7 has been found. The bug is caused by an incorrect implementation of the functions clean_filename() and clean_string() which causes a stack buffer overflow when parsing a configuration file with "long" paths (more than 20 characters).

The attacker can to create a specially-crafted sniffit configuration file, which is able to bypass all three protection mechanisms:

Non-eXecutable bit NX
Stack Smashing Protector SSP
Address Space Layout Randomisation ASLR
And execute arbitrary code with root privileges (the id of the user that launches the sniffit).
The new issue has been assigned CVE-2014-5439.

The presented PoC successfully exploits the vulnerability.
Original languageEnglish
Publication statusPublished - 2014


Dive into the research topics of 'CVE-2014-5439 - root shell on sniffit'. Together they form a unique fingerprint.

Cite this