CVE-2004-1224 Off-by-one error in the mtr_curses_keyaction function for mtr 0.55 through 0.65 allows local users to hijack raw sockets, as demonstrated using the "s" keybinding, which leaves a buffer without a NULL...
MediumCVSS 4.6
EPSS 0.33%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Off-by-one error in the mtr_curses_keyaction function for mtr 0.55 through 0.65 allows local users to hijack raw sockets, as demonstrated using the "s" keybinding, which leaves a buffer without a NULL terminator.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mtr | = 0.55 | No fix listed |
| mtr | = 0.56 | No fix listed |
| mtr | = 0.57 | No fix listed |
| mtr | = 0.58 | No fix listed |
| mtr | = 0.59 | No fix listed |
| mtr | = 0.60 | No fix listed |
| mtr | = 0.61 | No fix listed |
| mtr | = 0.62 | No fix listed |
| mtr | = 0.63 | No fix listed |
| mtr | = 0.64 | No fix listed |
| mtr | = 0.65 | No fix listed |
| debian/mtr(Debian:12) | < 0.67-1 | 0.67-1 |
| debian/mtr(Debian:13) | < 0.67-1 | 0.67-1 |
| debian/mtr(Debian:14) | < 0.67-1 | 0.67-1 |
References
- 20041211 Local off-by-one in mtr versions 0.55 to 0.65 mailing-list
- mtr-mtrcurseskeyaction-offbyone-bo(18428) vdb-entry
- Debian Security Tracker CVE-2004-1224 vendor-advisory