PT-2019-20138 · Secdev · Scapy

Publicado 2019-07-19 · Atualizado 2019-07-19

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions scapy version 2.4.0

Description The issue is related to a Denial of Service, which can cause an infinite loop, resource consumption, and make the program unresponsive. The component affected is the RADIUSAttrPacketListField.getfield(self..) function. The attack can be launched over the network or via a pcap file.

Recommendations For scapy version 2.4.0, consider disabling the RADIUSAttrPacketListField.getfield(self..) function as a temporary workaround to prevent potential exploitation until a patch is available. Restrict access to the network and limit the use of pcap files to minimize the risk of exploitation.

Identificadores relacionados

PYSEC-2019-50

Produtos afetados

Scapy

Referências · 7

• https://github.com/secdev/scapy/pull/1409/files#diff-441eff981e466959968111fc6314fe93L1058 · Nota
• https://github.com/secdev/scapy/pull/1409 · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/42NRPMC3NS2QVFNIXYP6WV2T3LMLLY7E · Aviso do Fabricante
• https://imperva.com/blog/scapy-sploit-python-network-tool-is-vulnerable-to-denial-of-service-dos-attack-cve-pending · Nota
• http://securityfocus.com/bid/106674 · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/T46XW4S5BCA3VV3JT3C5Q6LBEXSIACLN · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2019-50 · Aviso do Fabricante