Ubuntu Linux - A malicious RPKI rsync repository can prevent Fort from finishing its validation run by drip-feeding its content.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7813-1 advisory.

    Niklas Vogel and Haya Schulmann discovered that FORT Validator did not perform proper input validation     when parsing certain RPKI repository data. A remote attacker could possibly use this issue to cause FORT     Validator to crash, resulting in a denial of service. (CVE-2024-45234, CVE-2024-45235, CVE-2024-45236,     CVE-2024-45238, CVE-2024-45239)

    Niklas Vogel and Haya Schulmann discovered that FORT Validator did not perform proper input validation     when parsing resource certificates. A remote attacker could possibly use this issue to cause a denial of     service or execute arbitrary code. (CVE-2024-45237)

    Koen van Hove discovered that FORT Validator did not limit the duration of data transfers when fetching     RPKI repository data. A remote attacker could possibly use this issue to cause FORT Validator to consume     excessive resources, resulting in a denial of service. (CVE-2024-48943)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Ubuntu Linux - A malicious RPKI rsync repository can prevent Fort from finishing its validation run by     drip-feeding its content. (CVE-2024-48943)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4066 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4066-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     February 24, 2025                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : fort-validator     Version        : 1.5.3-1~deb11u2     CVE ID         : CVE-2024-45234 CVE-2024-45235 CVE-2024-45236 CVE-2024-45237                      CVE-2024-45238 CVE-2024-45239 CVE-2024-48943

    Multiple vulnerabilities have been discovered in fort-validator, a RPKI     validator and RTR server.

    CVE-2024-45234

       A malicious RPKI repository that descends from a (trusted) Trust        Anchor can serve (via rsync or RRDP) an ROA or a Manifest containing        a signedAttrs encoded in non-canonical form. This bypasses Fort's        BER decoder, reaching a point in the code that panics when faced        with data not encoded in DER. Because Fort is an RPKI Relying Party,        a panic can lead to Route Origin Validation unavailability, which        can lead to compromised routing.


    CVE-2024-45235

       A malicious RPKI repository that descends from a (trusted) Trust        Anchor can serve (via rsync or RRDP) a resource certificate        containing an Authority Key Identifier extension that lacks the        keyIdentifier field. Fort references this pointer without sanitizing        it first. Because Fort is an RPKI Relying Party, a crash can lead to        Route Origin Validation unavailability, which can lead to        compromised routing.

    CVE-2024-45236

       A malicious RPKI repository that descends from a (trusted) Trust        Anchor can serve (via rsync or RRDP) a signed object containing an        empty signedAttributes field. Fort accesses the set's elements        without sanitizing it first. Because Fort is an RPKI Relying Party,        a crash can lead to Route Origin Validation unavailability, which        can lead to compromised routing.

    CVE-2024-45237

       A malicious RPKI repository that descends from a (trusted) Trust        Anchor can serve (via rsync or RRDP) a resource certificate        containing a Key Usage extension composed of more than two bytes of        data. Fort writes this string into a 2-byte buffer without properly        sanitizing its length, leading to a buffer overflow.

    CVE-2024-45238

       A malicious RPKI repository that descends from a (trusted) Trust        Anchor can serve (via rsync or RRDP) a resource certificate        containing a bit string that doesn't properly decode into a Subject        Public Key. OpenSSL does not report this problem during parsing, and        when compiled with OpenSSL libcrypto versions below 3, Fort        recklessly dereferences the pointer. Because Fort is an RPKI Relying        Party, a crash can lead to Route Origin Validation unavailability,        which can lead to compromised routing.

    CVE-2024-45239

       A malicious RPKI repository that descends from a (trusted) Trust        Anchor can serve (via rsync or RRDP) an ROA or a Manifest containing        a null eContent field. Fort dereferences the pointer without        sanitizing it first. Because Fort is an RPKI Relying Party, a crash        can lead to Route Origin Validation unavailability, which can lead        to compromised routing.

    CVE-2024-48943

       A malicious RPKI rsync repository can prevent Fort from finishing        its validation run by drip-feeding its content. The delayed        validation can lead to stale or unavailable Route Origin Validation.

    For Debian 11 bullseye, these problems have been fixed in version     1.5.3-1~deb11u2.

    We recommend that you upgrade your fort-validator packages.

    For the detailed security status of fort-validator please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/fort-validator

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

    Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
269794	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : FORT Validator vulnerabilities (USN-7813-1)	Nessus	Ubuntu Local Security Checks	critical
231449	Linux Distros Unpatched Vulnerability : CVE-2024-48943	Nessus	Misc.	critical
216672	Debian dla-4066 : fort-validator - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2024-48943

critical

Tenable Plugins

critical

critical

critical