Actu
Vigil@nce: ntop, denial of service
August 2009 by Vigil@nce
An attacker can use a malicious HTTP Basic authentication in order
to stop ntop.
Severity: 2/4
Consequences: denial of service of service
Provenance: intranet client
Means of attack: 1 attack
Ability of attacker: technician (2/4)
Confidence: confirmed by the editor (5/5)
Diffusion of the vulnerable configuration: high (3/3)
Creation date: 19/08/2009
IMPACTED PRODUCTS
– Unix - plateform
DESCRIPTION OF THE VULNERABILITY
The ntop program displays network statistics on a web site,
requiring an HTTP Basic authentication.
An HTTP Basic authentication encodes the string "login:password"
in base64. The checkHTTPpassword() function of the http.c file
decodes this string and searches the ’:’ character to split the
username and the password. However, if there is no ’:’, the
username is set to NULL. This NULL pointer is used in the strlen()
function, which stops the service.
An attacker can therefore use a malicious HTTP Basic
authentication in order to stop ntop.
CHARACTERISTICS
Identifiers: BID-36074, CVE-2009-2732, VIGILANCE-VUL-8958
http://vigilance.fr/vulnerability/ntop-denial-of-service-8958
