Description
ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_softether_host_fqdn() in softether.c that compares host_name using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp to read beyond the packet payload buffer.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ntop nDPI
Default version status: unaffected
0 to ≤ 6.0affected
pkg:github/ntop/ndpiReferences
- https://github.com/ntop/nDPI/pull/3298 ↗
- https://github.com/ntop/nDPI/commit/ca9d819151606377ac53305583fe819748c69be2 ↗
- https://github.com/ntop/nDPI ↗
- https://github.com/ntop/nDPI/blob/6.0/src/lib/protocols/softether.c#L203 ↗
- https://hackmd.io/@haindpwn/ndpi-softether-host-fqdn-strncmp-oob-read ↗
- https://github.com/ntop/nDPI/issues/3291 ↗
- https://www.vulncheck.com/advisories/ntop-ndpi-through-6.0-out-of-bounds-read-in-softether-dissector ↗