Stack-buffer-overflow in tlsCheckUncommonALPN in ndpi
Summary
OSV-2022-445: Stack-buffer-overflow in tlsCheckUncommonALPN. Affects ndpi versions >= f25deeccb1ccbebd6346271828762fdd8326c32b, < 9040bc74c94dbd44cd86b29ec3de40621df53467. Fixed in 9040bc74c94dbd44cd86b29ec3de40621df53467. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ndpi is an open-source library used for deep packet inspection. It provides functionality to analyze network traffic and identify protocols. The library is commonly used in network monitoring and security applications. However, a vulnerability has been discovered in the tlsCheckUncommonALPN function of ndpi, which can lead to a stack buffer overflow.
Vulnerability Detail
The vulnerability in ndpi's tlsCheckUncommonALPN function allows for a stack buffer overflow. This can be triggered during the processing of a client-server hello message in the TLS handshake. An attacker can exploit this vulnerability by sending a specially crafted hello message, causing the function to write beyond the bounds of the allocated buffer. This can result in arbitrary code execution or a denial of service condition. The vulnerability has been assigned a high severity rating.
How To Fix
Minimum fixed version
9040bc74c94dbd44cd86b29ec3de40621df53467
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the fix by updating the ndpi library.
Conclusion
The stack-buffer-overflow vulnerability in ndpi's tlsCheckUncommonALPN function poses a significant risk to systems utilizing the library. It is crucial to update to a version that includes the fix to mitigate the potential for arbitrary code execution or denial of service. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ndpi →
FAQ
ndpi is an open-source library used for deep packet inspection. It is commonly used in network monitoring and security applications.
The vulnerability allows for a stack buffer overflow, which can lead to arbitrary code execution or a denial of service condition.
An attacker can exploit the vulnerability by sending a specially crafted hello message during the TLS handshake.
Yes, the vulnerability has been fixed in commit 9040bc74c94dbd44cd86b29ec3de40621df53467 in the GitHub repository.
The vulnerability has been assigned a high severity rating.
References
Related vulnerabilities
Recent vulnerabilities recorded for ndpi.
