PT-2019-20138 · Secdev · Scapy

Published 2019-07-19 · Updated 2019-07-19

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions scapy version 2.4.0

Description The issue is related to a Denial of Service, which can cause an infinite loop, resource consumption, and make the program unresponsive. The component affected is the RADIUSAttrPacketListField.getfield(self..) function. The attack can be launched over the network or via a pcap file.

Recommendations For scapy version 2.4.0, consider disabling the RADIUSAttrPacketListField.getfield(self..) function as a temporary workaround to prevent potential exploitation until a patch is available. Restrict access to the network and limit the use of pcap files to minimize the risk of exploitation.

Related Identifiers

PYSEC-2019-50

Affected Products

Scapy

References · 7

• https://lists.fedoraproject.org/archives/list/[e-mail]/message/42NRPMC3NS2QVFNIXYP6WV2T3LMLLY7E · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/T46XW4S5BCA3VV3JT3C5Q6LBEXSIACLN · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-50 · Vendor Advisory
• https://github.com/secdev/scapy/pull/1409/files#diff-441eff981e466959968111fc6314fe93L1058 · Note
• https://github.com/secdev/scapy/pull/1409 · Note
• https://imperva.com/blog/scapy-sploit-python-network-tool-is-vulnerable-to-denial-of-service-dos-attack-cve-pending · Note
• http://securityfocus.com/bid/106674 · Note