Bug 51135

Summary: Possible traceroute6 security flaw
Product: [Retired] Red Hat Linux Reporter: Chris Evans <chris>
Component: iputilsAssignee: Phil Knirsch <pknirsch>
Status: CLOSED RAWHIDE QA Contact: Aaron Brown <abrown>
Severity: medium Docs Contact:
Priority: medium    
Version: 7.3CC: notting, rvokal
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2001-08-16 14:51:10 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Chris Evans 2001-08-07 19:28:10 UTC 
Description of Problem:

Possible traceroute6 security flaw, demo follows
n.b. you need the ipv6 module loaded (luckily?)

[chris@localhost chris]$ /usr/sbin/traceroute6 ::1 8
traceroute to ::1 (::1) from ::1, 30 hops max, 8 byte packets
Segmentation fault

How Reproducible:

Every time

Steps to Reproduce:
As above.

Additional Information:
Looking at the code, this looks to be a heap mismanagement
flaw - data is written over the end of a malloc chunk. May
or may not be exploitable.
Note that traceroute6 drops root privs and just retains a
raw socket, so severity is limited.
I will notify vendor-sec shortly and cc: Alexey (iputils
maintainer).
Note, there might be other issues, I caught this via a
quick sanity scan since traceroute6 is a new suid-root
binary in RH7.2beta3
Comment 1 Glen Foster 2001-08-07 20:07:38 UTC 
This defect is considered SHOULD-FIX for Fairfax
Comment 2 Phil Knirsch 2001-08-27 15:48:21 UTC 
Fixed in iputils-20001110-6. Soon to appear on rawhide.

Read ya, Phil