Vulnerability Note VU#946652

pWhois Layer Four Traceroute 3.x vulnerability

Overview

Given a specific set of command line arguments, Layer Four Traceroute (lft) will produce a segmentation fault leading to a possible privilege escalation vulnerability.

I. Description

pWhois Layer Four Traceroute 3.x contains a vulnerability when parsing command line arguments. Earlier versions of Layer Four Traceroute may also be vulnerable. Some distributions that package Layer Four Traceroute are not vulnerable because they do not install the 'lft' binary SETUID root.

II. Impact

If Layer Four Traceroute is installed SETUID root, a local attacker may be able to exploit the vulnerability for privilege escalation.

III. Solution

Apply an Update

Upgrade to Layer Four Traceroute 3.3 or later.

Workaround

If upgrading to the latest version is not possible, do not install Layer Four Traceroute SETUID root. This will limit the application functionality for unprivileged users.

Vendor Information

Vendor	Status	Date Notified	Date Updated
Debian GNU/Linux	Unknown	2011-02-22	2011-02-22
FreeBSD Project	Unknown	2011-02-22	2011-02-22
Gentoo Linux	Unknown	2011-02-22	2011-02-22
pwhois_lft	Affected	2011-01-19	2011-04-04
Red Hat, Inc.	Not Affected	2011-02-22	2011-04-04
Slackware Linux Inc.	Not Affected	2011-02-22	2011-04-04
SUSE Linux	Not Affected	2011-02-22	2011-04-04
Ubuntu	Not Affected	2011-02-22	2011-04-04

References

http://pwhois.org/lft/

Credit

Thanks to Markus Gothe for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

Date Public:	2011-04-04
Date First Published:	2011-04-04
Date Last Updated:	2011-04-04
CERT Advisory:
CVE-ID(s):	CVE-2011-0765
NVD-ID(s):	CVE-2011-0765
US-CERT Technical Alerts:
Severity Metric:	0.00
Document Revision:	17