Security Advisory: Two Vulnerabilities in NetworkMiner
Security Advisory ID: NETRESEC-1386968
NetworkMiner version 1.4.1 and older is vulnerable to DLL hijacking and contains a directory traversal vulnerability.
Description
NetworkMiner is a tool designed for network forensics and network security monitoring. It is primarily used in order to analyze captured network traffic in PCAP files, but can also be used for live sniffing.
NetworkMiner uses Dynamically Linked Libraries (DLLs) for parts of its functionality. The location of these DLLs are not specified using a fully qualified path name, which makes the application vulnerable to DLL hijacking. The DLL hijacking can occur if NetworkMiner is used to open a pcap file from an attacker-controlled directory.
An important part of NetworkMiner's functionality is the ability to extract files from sniffed network traffic. NetworkMiner supports file extraction from protocols such as HTTP, FTP, TFTP, SMB, SMTP and the OSCAR protocol (used by AOL's ICQ and AIM). Files extracted from network traffic are written to a sub-directory of NetworkMiner called ”AssembledFiles”. However, due to a directory traversal vulnerability in NetworkMiner, a malicious PCAP file loaded by NetworkMiner can cause files to be written to directories other than ”AssembledFiles”.
Impact
Both vulnerabilities can allow an attacker to execute arbitrary code on the victim's machine. For an attack to be successful the victim must open a specially crafted malicious PCAP file or open a PCAP file from an insecure location.
Solution
These two vulnerabilities have been fixed in NetworkMiner 1.5 and NetworkMiner Professional 1.5.
Please visit our NetworkMiner page to download the latest free version of NetworkMiner:
http://www.netresec.com/?page=Networkminer
Customers who have purchased a previous version of NetworkMiner Professional can download an update for free from our customer portal.
Credit Statement
We would like to thank Alyssa Milburn for reporting the directory traversal vulnerability and Ucha Gobejishvili for reporting the DLL hijacking vulnerability. We would also like to thank Jonas Lejon and Claus Valca for finding and reporting two bugs that now have been fixed in NetworkMiner 1.5.
External References
Posted by Erik Hjelmvik on Wednesday, 07 August 2013 18:55:00 (UTC/GMT)
Tags: #NetworkMiner #PCAP
