The ip_evictor function in ip_fragment.c in libnids before 1.24, as used in dsniff and possibly other products, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via crafted fragmented packets.

libnids 1.24 (Mar 14 2010): - fixed another remotely triggerable NULL dereference in ip_fragment.c - unofficial patch that enables tracking of already established TCP connections - missing reset of some tcp_* variables upon nids_exit - correct calculation of radiotap header - compilation warning fixes with newer gcc - use pcap_get_selectable_fd() instead of pcap_fileno() dsniff-2.4-0.9.b1: - Rebuild against libnids 1.24

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
47403	Fedora 13 : dsniff-2.4-0.9.b1.fc13 / libnids-1.24-1.fc13 (2010-5562)	Nessus	Fedora Local Security Checks	medium
47400	Fedora 11 : dsniff-2.4-0.9.b1.fc11 / libnids-1.24-1.fc11 (2010-5545)	Nessus	Fedora Local Security Checks	medium
47398	Fedora 12 : dsniff-2.4-0.9.b1.fc12 / libnids-1.24-1.fc12 (2010-5535)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2010-0751

high

Tenable Plugins

medium

medium

medium