TCPreen FD_SET() buffer overflow
| tcpreen-fdset-bo (39241) |  High Risk |
Description:
TCPreen is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the FD_SET() function in the SocketAddress::Connect() method. By establishing multiple concurrent connections, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
Platforms Affected:
- Debian, Debian Linux 4.0
- Rémi Denis-Courmont, TCPreen prior to 1.4.4
Remedy:
Upgrade to the latest version of TCPreen (1.4.4 or later), available from the TCPreen Web page. See References.
Consequences:
Gain Access
References:
- TCPreen RELEASE NOTES, STABLE RELEASE 1.4.4 : Minor security fix at http://anonsvn.remlab.net/svn/tcpreen/tags/1.4.4/NEWS.
- TCPreen Web page, TCPreen at http://www.remlab.net/tcpreen/.
- BID-27018: TCPreen 'FD_SET()' Remote Buffer Overflow Vulnerability
- CVE-2007-6562: Multiple stack-based buffer overflows in the use of FD_SET in TCPreen before 1.4.4 allow remote attackers to cause a denial of service via multiple concurrent connections, which result in overflows in the (1) SocketAddress::Connect function in libsolve/sockprot.cpp and (2) monitor_bridge function in src/bridge.cpp.
- DSA-1443: tcpreen -- buffer overflows
- SA28217: TCPreen FD_SET Buffer Overflow Vulnerability
- VUPEN/ADV-2007-4318: TCPreen SocketAddress::Connect() and monitor_bridge() Overflow
Reported:
Dec 25, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net