ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_softether_host_fqdn() in softether.c that compares host_name using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp to read beyond the packet payload buffer.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 7
https://github.com/ntop/nDPI
disclosure@vulncheck.com
https://github.com/ntop/nDPI/blob/6.0/src/lib/protocols/softether.c#L203
disclosure@vulncheck.com
https://github.com/ntop/nDPI/commit/ca9d819151606377ac53305583fe819748c69be2
disclosure@vulncheck.com
https://github.com/ntop/nDPI/issues/3291
disclosure@vulncheck.com
https://github.com/ntop/nDPI/pull/3298
disclosure@vulncheck.com
https://hackmd.io/@haindpwn/ndpi-softether-host-fqdn-strncmp-oob-read
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/ntop-ndpi-through-6.0-out-of-bounds-read-i…
disclosure@vulncheck.com