CVE-2014-5439: Buffer Overflow
Published Nov 19, 2019
·Updated
Multiple Stack-based Buffer Overflow vulnerabilities exists in Sniffit prior to 0.3.7 via a crafted configuration file that will bypass Non-eXecutable bit NX, stack smashing protector SSP, and address space layout randomization ASLR protection mechanisms, which could let a malicious user execute arbitrary code.
Affected Software
4 affected components
Sniffit Project Sniffit<=0.3.7
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Remediation
Event History
Nov 19, 2019
CVE Published
via MITRE·03:05 PM
Data Sourced
via MITRE·03:05 PM
Description
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The attacker needs to induce Sniffit to process a crafted configuration file. The CVSS vector indicates no privileges are required, but user interaction is required.
2
Are common memory-protection mitigations sufficient to prevent exploitation?
No. The issue is described as bypassing NX, SSP, and ASLR protection mechanisms, allowing arbitrary code execution through the crafted configuration file.
3
Which versions require remediation?
Sniffit versions prior to 0.3.7 are affected. A patch is available.