Bug 51135 - Possible traceroute6 security flaw
Possible traceroute6 security flaw
Status: CLOSED RAWHIDE
Product: Red Hat Linux
Classification: Retired
Component: iputils (Show other bugs)
7.3
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Phil Knirsch
Aaron Brown
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2001-08-07 15:28 EDT by Chris Evans
Modified: 2015-03-04 20:09 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2001-08-16 10:51:10 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Chris Evans 2001-08-07 15:28:10 EDT
Description of Problem:

Possible traceroute6 security flaw, demo follows
n.b. you need the ipv6 module loaded (luckily?)

[chris@localhost chris]$ /usr/sbin/traceroute6 ::1 8
traceroute to ::1 (::1) from ::1, 30 hops max, 8 byte packets
Segmentation fault

How Reproducible:

Every time

Steps to Reproduce:
As above.

Additional Information:
Looking at the code, this looks to be a heap mismanagement
flaw - data is written over the end of a malloc chunk. May
or may not be exploitable.
Note that traceroute6 drops root privs and just retains a
raw socket, so severity is limited.
I will notify vendor-sec shortly and cc: Alexey (iputils
maintainer).
Note, there might be other issues, I caught this via a
quick sanity scan since traceroute6 is a new suid-root
binary in RH7.2beta3
Comment 1 Glen Foster 2001-08-07 16:07:38 EDT
This defect is considered SHOULD-FIX for Fairfax
Comment 2 Phil Knirsch 2001-08-27 11:48:21 EDT
Fixed in iputils-20001110-6. Soon to appear on rawhide.

Read ya, Phil

Note You need to log in before you can comment on or make changes to this bug.