Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Active
User action required
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
References 4
https://github.com/nmap/nmap
disclosure@vulncheck.com
https://github.com/nmap/nmap/commit/7ef4ee030a0023fe22616387a000032e1a678b6a
disclosure@vulncheck.com
https://github.com/nmap/nmap/issues/3368
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/nmap-denial-of-service-via-zero-length-tcp…
disclosure@vulncheck.com