PT-2024-35736 · Ntopng · Ntopng

Cla7Aye15I4Ndo · Published 2024-11-21 · Updated 2024-11-26 · CVE-2024-53426

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ntopng version 6.2

Description A heap-buffer-overflow issue has been identified in the Flow::dissectMDNS function. This issue can potentially lead to a buffer overflow, which may cause the program to crash or execute arbitrary code.

Recommendations For ntopng version 6.2, consider disabling the Flow::dissectMDNS function until a patch is available to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

AZL-53513

AZL-53783

CVE-2024-53426

Affected Products

Ntopng

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-53426 · Security Note
• https://ubuntu.com/security/CVE-2024-53426 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-53426 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-53513 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-53783 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-53426 · Security Note
• https://osv.dev/vulnerability/CVE-2024-53426 · Vendor Advisory
• https://github.com/ntop/ntopng/issues/8793 · Note
• https://twitter.com/CVEnew/status/1859601812615201201 · Twitter Post