PT-2020-12935 · Ntop · Ndpi

Anticomputer + 1 · Published 2020-04-23 · Updated 2021-07-21 · CVE-2020-11939

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nDPI versions 3.2 Stable and earlier

Description The SSH protocol dissector in nDPI has multiple KEXINIT integer overflows, resulting in a controlled remote heap overflow in concat hash string in ssh.c. This issue can be exploited to achieve full Remote Code Execution against any network inspection stack linked against nDPI that uses it for network traffic analysis.

Recommendations For nDPI versions 3.2 Stable and earlier, consider disabling the SSH protocol dissector as a temporary workaround until a patch is available. Restrict access to the ssh.c module to minimize the risk of exploitation. Avoid using the concat hash string function in the affected SSH protocol dissector until the issue is resolved.

Exploit

Fix

Integer Overflow

Memory Corruption

Weakness Enumeration

CWE-190

CWE-787

Related Identifiers

CVE-2020-11939

Affected Products

Ndpi

References · 10

• 🔥 https://securitylab.github.com/advisories/GHSL-2020-051_052-ntop-ndpi · Exploit
• https://github.com/ntop/nDPI/commit/7ce478a58b4dd29a8d1e6f4e9df2f778613d9202 · Patch
• https://cve.org/CVERecord?id=CVE-2020-11939 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11939 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-11939 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-11939 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11939 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-11939 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11939 · Security Note
• https://t.me/cvenotify/3096 · Telegram Post