Memory Leak Vulnerability in OpenNDS: Denial-of-Service Risk
Summary
DEBIAN-CVE-2023-41102: An issue was discovered in the captive portal in OpenNDS before version 10.1.3. Affects opennds versions < 10.2.0+dfsg-1. Fixed in 10.2.0+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenNDS is an open-source network access control solution that provides a captive portal for managing user access to network resources. It is designed to facilitate secure and controlled access to networks, often used in environments such as public Wi-Fi networks. The package is known for its flexibility and ease of integration with various network setups. However, prior to version 10.1.3, OpenNDS had a critical vulnerability that could lead to significant memory management issues.
Vulnerability Detail
An issue was discovered in the captive portal of OpenNDS before version 10.1.3, characterized by multiple memory leaks due to the failure to free allocated memory. This vulnerability can lead to a Denial-of-Service (DoS) condition, as the application may consume all available memory resources, rendering the service inoperable. The vulnerability was identified and fixed in version 10.2.0, which was released on November 23, 2023.
How To Fix
Minimum fixed version
10.2.0+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade openndsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the latest version of OpenNDS as soon as possible.
Conclusion
The memory leak vulnerability in OpenNDS poses a significant risk of Denial-of-Service due to unfreed allocated memory. Users are strongly advised to update to version 10.2.0 or later to mitigate this risk. Regular monitoring and updates are essential for maintaining the security of your network access solutions.
See every vulnerability recorded for opennds →
FAQ
The memory leak can lead to a Denial-of-Service condition, causing the application to consume all available memory and potentially crash.
You can verify your version of OpenNDS by running 'opennds --version' in your terminal. If it is below 10.1.3, it is affected.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application for vulnerabilities using the Vulert playground without any signup.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk of a Denial-of-Service attack.
Detailed information about this vulnerability can be found in the Debian CVE database and other security advisories related to OpenNDS.
References
Related vulnerabilities
Recent vulnerabilities recorded for opennds.
