Heap-buffer-overflow in ndpi_netbios_name_interpret
Summary
OSV-2020-49: Heap-buffer-overflow in ndpi_netbios_name_interpret. Affects ndpi versions >= 7234f369499e02f44efcbbf0efe43bae596ddc53, < 4f370fe7c49cb38125cff2a1411261011e433c94. Fixed in 4f370fe7c49cb38125cff2a1411261011e433c94. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ndpi package is an open-source library that provides deep packet inspection (DPI) functionality. It is used for network traffic analysis and classification. The package is primarily designed to identify protocols and applications running on a network. However, a vulnerability has been discovered in the ndpi package that could lead to a heap-buffer-overflow.
Vulnerability Detail
The vulnerability in the ndpi package is a heap-buffer-overflow, specifically in the ndpi_netbios_name_interpret function. This vulnerability allows an attacker to read beyond the bounds of a heap buffer, potentially leading to information disclosure or remote code execution. The issue was reported through the OSS-Fuzz project and has been assigned the identifier OSV-2020-49. The vulnerability has a medium severity rating and affects versions of the ndpi package from commit 2efc09a20e6503d99fe3d76fcc16b1892fb7c7ff to 5c52c00ea4ad8afaebd5259bc53215a1ab41569f. The vulnerability was fixed in commit 4f370fe7c49cb38125cff2a1411261011e433c94.
How To Fix
Minimum fixed version
4f370fe7c49cb38125cff2a1411261011e433c94
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix as soon as possible.
Conclusion
The ndpi package has been found to have a heap-buffer-overflow vulnerability in the ndpi_netbios_name_interpret function. This vulnerability could potentially lead to information disclosure or remote code execution. It is recommended to update the package to a fixed version as soon as possible. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ndpi →
FAQ
The vulnerability could allow an attacker to read beyond the bounds of a heap buffer, potentially leading to information disclosure or remote code execution.
The vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzz testing on open-source software.
The vulnerability has a medium severity rating.
Versions of the ndpi package from commit 2efc09a20e6503d99fe3d76fcc16b1892fb7c7ff to 5c52c00ea4ad8afaebd5259bc53215a1ab41569f are affected.
You can use the Vulert playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for ndpi.
