Description
Buffer overflow in the run_last_args function in client/fwknop.c in fwknop before 2.0.3, when processing --last, might allow local users to cause a denial of service (client crash) and possibly execute arbitrary code via many .fwknop.run arguments.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | fwknop | 2.0.3-1 | — |
| Debian 13 | fwknop | 2.0.3-1 | — |
| Debian 12 | fwknop | 2.0.3-1 | — |
References
- [oss-security] 20120919 CVE Request -- fwknop 2.0.3: Multiple security issues mailing-list
- [oss-security] 20120919 Re: CVE Request -- fwknop 2.0.3: Multiple security issues mailing-list
- http://www.cipherdyne.org/blog/2012/09/software-release-fwknop-2.0.3.html
- http://www.cipherdyne.org/cgi-bin/gitweb.cgi?p=fwknop.git%3Ba=commitdiff%3Bh=a60f05ad44e824f6230b22f8976399340cb535dc