PT-2024-10174 · Iptraf-Ng+4 · Iptraf-Ng+4

Massimiliano Ferraresi · Published 2024-11-18 · Updated 2025-10-14 · CVE-2024-52949

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions iptraf-ng version 1.2.1

Description The issue is related to a stack-based buffer overflow in the iptraf-ng utility, which can be exploited by a remote attacker to execute arbitrary code. This occurs due to the strcpy function in src/ifaces.c failing to control the size of input data, leading to a potential overflow of memory on the stack.

Recommendations For iptraf-ng version 1.2.1, consider disabling the strcpy function in src/ifaces.c or restricting its use until a patch is available to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-120

Related Identifiers

ALSA-2025:7064

AZL-54386

AZL-54389

BDU:2025-00501

CVE-2024-52949

INFSA-2025_7064

MGASA-2024-0381

OESA-2024-2499

OESA-2024-2500

OESA-2024-2560

OESA-2024-2561

OESA-2024-2562

OPENSUSE-SU-2024:14516-1

RHSA-2025:7064

RHSA-2025_7064

Affected Products

Almalinux

Debian

Red Hat

Rocky Linux

Iptraf-Ng

References · 45

• 🔥 https://gruppotim.it/it/footer/red-team.html · Exploit
• https://security-tracker.debian.org/tracker/CVE-2024-52949 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14516-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52949 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-52949 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-52949 · Security Note
• https://osv.dev/vulnerability/ALSA-2025:7064 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2561 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-54386 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52949 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-7064.html · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2025-7064.html · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2562 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2025:7064 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-52949 · Vendor Advisory