AntiSniff DNS Overflow Vulnerability

TITLE: AntiSniff DNS Overflow Vulnerability
CLASS: Boundary Condition Error
CVE:
REMOTE: Yes
LOCAL: Yes
PUBLISHED: May 16 2000 12:00AM
UPDATE: May 16 2000 12:00AM
CREDIT: This problem was discovered by Hugo Breton (bretonh@pgci.ca) who works for PGCI http://www.pgci.ca and was published by L0pht/@Stake in a vendor advisory 5.15.2000.
VULNERABLE:

@Stake AntiSniff - Researchers Version 1.0
@Stake AntiSniff 1.0.1
NOT VULNERABLE:

Vai alla pagina originale su Security Focus

Discussion

Certain versions of @Stake Inc.'s Antisniffer software contain a remotely exploitable buffer overflow. AntiSniff is a program that was released by L0pht Heavy Industries in July of 1999. It attempts, through a number of tests, to determine if a machine on a local network segment is listening to traffic that is not directed to it (commonly referred to as sniffing). During one particular test there is a problem if a packet that does not adhere to DNS specifications is sent to the AntiSniff machine. This can result in a buffer overflow on the system running AntiSniff. If the packet is crafted appropriately this overflow scenario can be exploited to execute arbitrary code on the system.

This scenario is only possible if AntiSniff is configured to run the DNS test and only during the time the test is running. Nonetheless, it is a vulnerability that should not be ignored and has even been found in other promiscuous mode detection programs as well.

NOTE:

This information was taken verbatim from the L0pht advisory on the subject. This advisory is attached in full in the 'Credit' section of this advisory.

Exploit

exploit available

Solution

Solution:
Immediate Solution:

Do not run the DNS tests on AntiSniff version 1.01 or the Researchers version 1.0. Download the newer version from http://www.l0pht.com/antisniff which are labeled AntiSniff version 1.02 for the commercial instance and AntiSniff version 1-1 for the researchers instance.


@Stake AntiSniff - Researchers Version 1.0


@Stake AntiSniff 1.0.1

References

References:

PhpLog

BNLug Benevento Linux Users Group