Wednesday, 07 August 2013 18:55:00 (UTC/GMT)

Security Advisory: Two Vulnerabilities in NetworkMiner

Security Advisory ID: NETRESEC-1386968

NetworkMiner version 1.4.1 and older is vulnerable to DLL hijacking and contains a directory traversal vulnerability.

NetworkMiner Logo

Description

NetworkMiner is a tool designed for network forensics and network security monitoring. It is primarily used in order to analyze captured network traffic in PCAP files, but can also be used for live sniffing.

NetworkMiner uses Dynamically Linked Libraries (DLLs) for parts of its functionality. The location of these DLLs are not specified using a fully qualified path name, which makes the application vulnerable to DLL hijacking. The DLL hijacking can occur if NetworkMiner is used to open a pcap file from an attacker-controlled directory.

An important part of NetworkMiner's functionality is the ability to extract files from sniffed network traffic. NetworkMiner supports file extraction from protocols such as HTTP, FTP, TFTP, SMB, SMTP and the OSCAR protocol (used by AOL's ICQ and AIM). Files extracted from network traffic are written to a sub-directory of NetworkMiner called ”AssembledFiles”. However, due to a directory traversal vulnerability in NetworkMiner, a malicious PCAP file loaded by NetworkMiner can cause files to be written to directories other than ”AssembledFiles”.

Impact

Both vulnerabilities can allow an attacker to execute arbitrary code on the victim's machine. For an attack to be successful the victim must open a specially crafted malicious PCAP file or open a PCAP file from an insecure location.

Solution

These two vulnerabilities have been fixed in NetworkMiner 1.5 and NetworkMiner Professional 1.5.

Please visit our NetworkMiner page to download the latest free version of NetworkMiner:
http://www.netresec.com/?page=Networkminer

Customers who have purchased a previous version of NetworkMiner Professional can download an update for free from our customer portal.

Credit Statement

We would like to thank Alyssa Milburn for reporting the directory traversal vulnerability and Ucha Gobejishvili for reporting the DLL hijacking vulnerability. We would also like to thank Jonas Lejon and Claus Valca for finding and reporting two bugs that now have been fixed in NetworkMiner 1.5.

External References

More... Share  |  Facebook   Twitter   Reddit   Hacker News Short URL: http://netresec.com/?b=1386968

Posted by Erik Hjelmvik on Wednesday, 07 August 2013 18:55:00 (UTC/GMT)

twitter

NETRESEC on Twitter

Follow @netresec on twitter:
» twitter.com/netresec


book

Recommended Books

» The Practice of Network Security Monitoring, Richard Bejtlich (2013)

» Applied Network Security Monitoring, Chris Sanders and Jason Smith (2013)

» Network Forensics, Sherri Davidoff and Jonathan Ham (2012)

» The Tao of Network Security Monitoring, Richard Bejtlich (2004)

» Practical Packet Analysis, Chris Sanders (2011)

» Windows Forensic Analysis, Harlan Carvey (2009)

» TCP/IP Illustrated, Volume 1, Kevin Fall and Richard Stevens (2011)

» Industrial Network Security, Eric D. Knapp and Joel Langill (2014)