Vulnerability CVE-2013-1428
Published: 2013-04-26

Description:
Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1pre7 allows remote authenticated peers to cause a denial of service (crash) or possibly execute arbitrary code via a large TCP packet.

See advisories in our WLB2 database:
Topic
Author
Date
High
Tincd Post-Authentication Remote TCP Stack Buffer Overflow
Martin
02.12.2014
High
Tincd Post-Authentication Remote TCP Stack Buffer Overflow
Martin Schobert
03.12.2014

Type:

CWE-119

 (Improper Restriction of Operations within the Bounds of a Memory Buffer)

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.5/10
6.4/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Tinc-vpn -> TINC 

 References:
https://github.com/gsliepen/tinc/commit/17a33dfd95b1a29e90db76414eb9622df9632320
http://www.tinc-vpn.org/pipermail/tinc/2013-April/003240.html
http://www.tinc-vpn.org/news/
http://www.securityfocus.com/bid/59369
http://www.debian.org/security/2013/dsa-2663
http://secunia.com/advisories/53108
http://secunia.com/advisories/53087
http://osvdb.org/92653
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106167.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105559.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105531.html
http://freecode.com/projects/tinc/releases/354122
Copyright 2024, cxsecurity.com

 

Back to Top