Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1pre7 allows remote authenticated peers to cause a denial of service (crash) or possibly execute arbitrary code via a large TCP packet.

- Wed Apr 24 2013 Fabian Affolter <mail at     fabian-affolter.ch> - 1.0.21-1

    - Updated to new upstream version 1.0.21

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

tinc-vpn.org reports :

Drop packets forwarded via TCP if they are too big.

Martin Schobert discovered a stack-based vulnerability in tinc, a Virtual Private Network (VPN) daemon.

When packets are forwarded via TCP, packet length is not checked against the stack buffer length. Authenticated peers could use this to crash the tinc daemon and maybe execute arbitrary code.

Note that on Wheezy and Sid, tinc is built using hardening flags and especially stack smashing protection, which should help protect against arbitrary code execution.

ID	Name	Product	Family	Severity
66592	Fedora 19 : tinc-1.0.21-1.fc19 (2013-7085)	Nessus	Fedora Local Security Checks	medium
66433	Fedora 17 : tinc-1.0.21-1.fc17 (2013-7128)	Nessus	Fedora Local Security Checks	medium
66432	Fedora 18 : tinc-1.0.21-1.fc18 (2013-7120)	Nessus	Fedora Local Security Checks	medium
66185	FreeBSD : tinc -- Buffer overflow (aeb962f6-ab8d-11e2-b3f5-003067c2616f)	Nessus	FreeBSD Local Security Checks	medium
66180	Debian DSA-2663-1 : tinc - stack based buffer overflow	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2013-1428

critical

Tenable Plugins

medium

medium

medium

medium

medium