PT-2020-14439 · Ntop · Ndpi

Name of the Vulnerable Software and Affected Versions: nDPI versions 3.2 and earlier Description: The issue is related to a heap-based buffer over-read in the H.323 dissector, specifically in the ndpi search h323 function located in lib/protocols/h323.c. This occurs when a payload packet length i...

PT-2020-22260

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN READ. The crash state involves several functions: ndpi search kerberos, check ndpi tcp flow func, and ndpi...

CVE-2020-15473: Out-of-bounds Read

In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpisearchopenvpn in lib/protocols/openvpn.c...

CVE-2020-15475: Use After Free

In nDPI through 3.2, ndpiresetpacketlineinfo in lib/ndpimain.c omits certain reinitialization, leading to a use-after-free...

CVE-2020-15471: Out-of-bounds Read

In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in ndpiparsepacketlineinfo in lib/ndpimain.c...

CVE-2020-15472: Out-of-bounds Read

In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpisearchh323 in lib/protocols/h323.c, as demonstrated by a payload packet length that is too short...

PT-2020-14442

Name of the Vulnerable Software and Affected Versions nDPI versions prior to 3.2 Description The issue arises from the ndpi reset packet line info function in lib/ndpi main.c, which fails to properly reinitialize certain data, resulting in a use-after-free situation. Recommendations For versions...

WS-2020-0420

In “ntop/nDPI”, v1.6 to v3.2 are vulnerable against use-after-free in “ndpiparsepacketlineinfo”. Some resources were accessed without first resetting them after they were freed...

PT-2020-14438

Name of the Vulnerable Software and Affected Versions nDPI versions prior to 3.2 Description The packet parsing code in nDPI is susceptible to a heap-based buffer over-read issue, specifically within the ndpi parse packet line info function located in lib/ndpi main.c. Recommendations For versions...

PT-2020-14441

Name of the Vulnerable Software and Affected Versions nDPI versions prior to 3.2 Description There is a stack overflow issue in the extractRDNSequence function located in lib/protocols/tls.c. Recommendations For versions prior to 3.2, update to version 3.2 or later to resolve the issue...

PT-2020-14443 · Ntop · Ndpi

Name of the Vulnerable Software and Affected Versions: nDPI versions 3.2 and earlier Description: The issue is related to a heap-based buffer over-read in the Oracle protocol dissector. This occurs in the ndpi search oracle function located in lib/protocols/oracle.c. Recommendations: For nDPI...

CVE-2020-15474: Out-of-bounds Write

In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c...

PT-2020-22203

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 2 crash has been reported. The crash occurs in the ndpi workflow process packet function, specifically in the fuzz ndpi reader....

PT-2020-22206

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-use-after-free READ 3 crash has been reported. The crash involves the functions ndpi http check content, check content type and change protocol, and...

PT-2020-22199

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 4 crash has been reported. The crash involves the functions get ndpi flow info6, packet processing, and ndpi workflow process...

ndpi:fuzz_ndpi_reader: Heap-use-after-free in check_content_type_and_change_protocol

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=5161200102146048 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzndpireader Job Type: libfuzzerasanndpi Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash Address: 0x62b0000102df Cra...

OSV-2020-92 Heap-buffer-overflow in ndpi_parse_packet_line_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22169 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpiparsepacketlineinfo ndpisearchmailsmtptcp checkndpitcpflowfunc...

OSV-2020-12 Use-of-uninitialized-value in ndpi_parse_packet_line_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23058 Crash type: Use-of-uninitialized-value Crash state: ndpiparsepacketlineinfo ndpicheckhttptcp ndpisearchhttptcp...

OSV-2020-28 Heap-buffer-overflow in get16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20712 Crash type: Heap-buffer-overflow READ 2 Crash state: get16 searchvaliddns ndpisearchdns...

PT-2020-22353

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow read issue is identified, potentially causing a crash. The crash involves the ndpi netbios name interpret, ndpi int netbios add...