CVE-2011-4093
published 2014-02-10CVE-2011-4093: Integer overflow in inc/server.hpp in libnet6 (aka net6) before 1.3.14 might allow remote attackers to hijack connections and gain privileges as other users by…
PriorityP429medium5.8CVSS 2.0
AVNACMAuNCPIPAN
EPSS
1.76%
75.7th percentile
Integer overflow in inc/server.hpp in libnet6 (aka net6) before 1.3.14 might allow remote attackers to hijack connections and gain privileges as other users by making a large number of connections until the overflow occurs and an ID of another user is provided.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| armin_burgmeier | net6 | <= 1.3.13 | — |
| armin_burgmeier | net6 | — | — |
| armin_burgmeier | net6 | — | — |
| armin_burgmeier | net6 | — | — |
| armin_burgmeier | net6 | — | — |
| armin_burgmeier | net6 | — | — |
| armin_burgmeier | net6 | — | — |
| armin_burgmeier | net6 | — | — |
| armin_burgmeier | net6 | — | — |
| armin_burgmeier | net6 | — | — |
| armin_burgmeier | net6 | — | — |
| armin_burgmeier | net6 | — | — |
| armin_burgmeier | net6 | — | — |
| opensuse | opensuse | — | — |
| opensuse_project | opensuse | — | — |
| oracle | solaris | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2011-4093 CVE-2011-4091 net6 various flaws [fedora-all]
bugzilla·2011-11-01·CVSS 5.0
CVE-2011-4093 [MEDIUM] CVE-2011-4093 CVE-2011-4091 net6 various flaws [fedora-all]
CVE-2011-4093 CVE-2011-4091 net6 various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=750631
Pl
Bugzilla
CVE-2011-4093 net6: integer overflow may lead to connection hijacking
bugzilla·2011-11-01·CVSS 5.8
CVE-2011-4093 [MEDIUM] CVE-2011-4093 net6: integer overflow may lead to connection hijacking
CVE-2011-4093 net6: integer overflow may lead to connection hijacking
Vasiliy Kulikov reported [1] that libnet6 did not check the basic_server::id_counter for integer overflows. This number is used to distinguish different users, so an attacker that was able to open UINT_MAX successive connections could get an identifier of an already existing connection, allowing them to hijack that user's connection.
Note that, as reported, on i686 uint is a 32 bit counter, so an attacker would need to open 4,000,000,000 connections in order to complete the attack.
This has been corrected in git [2].
[1] http://www.openwall.com/lists/oss-security/2011/10/30/3
[2] http://git.0x539.de/?p=net6.git;a=commitdiff;h=ac61d7fb42a1f977fb527e024bede319c4a9e169;hp=08c8e2261604c6fcbbaf62f9ae9d13f7015fcb9a
Discu
Bugzilla
CVE-2011-4093 CVE-2011-4091 net6 various flaws [epel-all]
bugzilla·2011-11-01·CVSS 5.0
CVE-2011-4093 [MEDIUM] CVE-2011-4093 CVE-2011-4091 net6 various flaws [epel-all]
CVE-2011-4093 CVE-2011-4091 net6 various flaws [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=750631
Plea
http://git.0x539.de/?p=net6.git%3Ba=commitdiff%3Bh=ac61d7fb42a1f977fb527e024bede319c4a9e169%3Bhp=08c8e2261604c6fcbbaf62f9ae9d13f7015fcb9ahttp://lists.opensuse.org/opensuse-updates/2012-01/msg00044.htmlhttp://lists.opensuse.org/opensuse-updates/2012-01/msg00054.htmlhttp://www.openwall.com/lists/oss-security/2011/10/31/1http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.htmlhttps://bugzilla.novell.com/show_bug.cgi?id=727710https://bugzilla.redhat.com/show_bug.cgi?id=750631http://git.0x539.de/?p=net6.git%3Ba=commitdiff%3Bh=ac61d7fb42a1f977fb527e024bede319c4a9e169%3Bhp=08c8e2261604c6fcbbaf62f9ae9d13f7015fcb9ahttp://lists.opensuse.org/opensuse-updates/2012-01/msg00044.htmlhttp://lists.opensuse.org/opensuse-updates/2012-01/msg00054.htmlhttp://www.openwall.com/lists/oss-security/2011/10/31/1http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.htmlhttps://bugzilla.novell.com/show_bug.cgi?id=727710https://bugzilla.redhat.com/show_bug.cgi?id=750631
2014-02-10
Published