Description
Off-by-one error in the mtr_curses_keyaction function for mtr 0.55 through 0.65 allows local users to hijack raw sockets, as demonstrated using the "s" keybinding, which leaves a buffer without a NULL terminator.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mtr | 0.67-1 | — |
| Debian 13 | mtr | 0.67-1 | — |
| Debian 12 | mtr | 0.67-1 | — |
References
- 20041211 Local off-by-one in mtr versions 0.55 to 0.65 mailing-list
- mtr-mtrcurseskeyaction-offbyone-bo(18428) vdb-entry