Ssldump
Monthly
A deterministic 3-byte heap-based buffer overflow in ssldump's FAN/1 X.509 fingerprinting routine (fanx_fingerprint in ssl/sslxprint.c) corrupts the heap on every call that processes a valid certificate. Exploitation requires the victim to run ssldump with FAN/1 fingerprinting enabled (the -j and -N options) against an attacker-supplied pcap containing a TLS handshake with a valid X.509 server certificate; the attack vector is local and depends on the user actively choosing to parse the malicious capture with non-default options. The most likely outcome is a crash/denial of service, with arbitrary code execution in the context of the ssldump user remaining a worst-case possibility; no public exploit code has been identified at time of analysis, and the overflow content is largely fixed, which makes code execution substantially harder than a denial of service.
A deterministic 3-byte heap-based buffer overflow in ssldump's FAN/1 X.509 fingerprinting routine (fanx_fingerprint in ssl/sslxprint.c) corrupts the heap on every call that processes a valid certificate. Exploitation requires the victim to run ssldump with FAN/1 fingerprinting enabled (the -j and -N options) against an attacker-supplied pcap containing a TLS handshake with a valid X.509 server certificate; the attack vector is local and depends on the user actively choosing to parse the malicious capture with non-default options. The most likely outcome is a crash/denial of service, with arbitrary code execution in the context of the ssldump user remaining a worst-case possibility; no public exploit code has been identified at time of analysis, and the overflow content is largely fixed, which makes code execution substantially harder than a denial of service.