CVE-2011-4093: Integer Overflow
Integer overflow in inc/server.hpp in libnet6 (aka net6) before 1.3.14 might allow remote attackers to hijack connections and gain privileges as other users by making a large number of connections until the overflow occurs and an ID of another user is provided.
Other sources
Vasiliy Kulikov reported [1] that libnet6 did not check the basicserver::idcounter for integer overflows. This number is used to distinguish different users, so an attacker that was able to open UINTMAX successive connections could get an identifier of an already existing connection, allowing them to hijack that user's connection.
Note that, as reported, on i686 uint is a 32 bit counter, so an attacker would need to open 4,000,000,000 connections in order to complete the attack.
This has been corrected in git [2].
[1] http://www.openwall.com/lists/oss-security/2011/10/30/3 [2] http://git.0x539.de/?p=net6.git;a=commitdiff;h=ac61d7fb42a1f977fb527e024bede319c4a9e169;hp=08c8e2261604c6fcbbaf62f9ae9d13f7015fcb9a
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4093?
CVE-2011-4093 has a high severity rating due to the potential for privilege escalation via remote connection hijacking.
How do I fix CVE-2011-4093?
To fix CVE-2011-4093, upgrade libnet6 to version 1.3.14 or later.
Who discovered the CVE-2011-4093 vulnerability?
The CVE-2011-4093 vulnerability was reported by Vasiliy Kulikov.
What software is affected by CVE-2011-4093?
CVE-2011-4093 affects libnet6 versions prior to 1.3.14 and certain versions of Oracle Solaris and openSUSE.
Is CVE-2011-4093 specific to certain operating systems?
Yes, CVE-2011-4093 primarily affects Oracle Solaris and openSUSE distributions.