PT-2018-11228 · Ntop+1 · Ntopng+1

Ioannis Profetis · Published 2018-07-05 · Updated 2024-02-10 · CVE-2018-12520

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ntopng versions prior to 3.4.180617

Description An issue was discovered where the pseudo-random number generator (PRNG) involved in generating session IDs is not seeded at program startup, resulting in deterministic session IDs for active user sessions. This allows an attacker with knowledge of the operating system, standard library, and target username to hijack a user's session and escalate their access.

Recommendations For versions prior to 3.4.180617, update to version 3.4.180617 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of session hijacking.

Exploit

Fix

Weakness Enumeration

CWE-335

Related Identifiers

CVE-2018-12520

USN-4842-1

Affected Products

Ubuntu

Ntopng

References · 12

• 🔥 https://gist.github.com/Psychotropos/3e8c047cada9b1fb716e6a014a428b7f · Exploit
• 🔥 https://exploit-db.com/exploits/44973 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2018/Jul/14 · Exploit
• https://github.com/ntop/ntopng/commit/30610bda60cbfc058f90a1c0a17d0e8f4516221a · Patch
• https://osv.dev/vulnerability/USN-4842-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12520 · Security Note
• https://osv.dev/vulnerability/CVE-2018-12520 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4842-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-12520 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12520 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-12520 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-12520 · Vendor Advisory