Buffer overflow in the addchar function in common/parseconf.c in upsd in Network UPS Tools (NUT) before 2.6.4 allows remote attackers to execute arbitrary code or cause a denial of service (electric-power outage) via a long string containing non-printable characters.

The nut upsd is prone to multiple flaws that allow remote attackers to cause a denial of service (application crash) by sending unexpected data.

This update of nuts fixes a denial of service flaw that could have been exploited by remote attackers to cause an application crash of upsd.

The remote host is affected by the vulnerability described in GLSA-201209-19 (NUT: Arbitrary code execution)

    An error in the addchar() function in parseconf.c may cause a buffer       overflow.
  Impact :

    A remote attacker could send a specially crafted string to upsd,       possibly resulting in execution of arbitrary code with the privileges of       the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update of nut fixes a denial of service flaw that could have been exploited by remote attackers to cause an application crash of upsd.

Sebastian Pohle discovered that UPSD, the server of Network UPS Tools (NUT) is vulnerable to a remote denial of service attack.

According to its self-reported version number, the installation of Network UPS Tools is affected by a buffer overflow caused by an error in the 'addchar()' function. An unauthenticated, remote attacker sending a specially crafted request to the server may trigger an application crash or the execution of arbitrary code.

fix heap-based buffer overflow due improper processing of non-printable characters in random network data (CVE-2012-2944)

  - no change, just updated release number to fix upgrade     path

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been discovered and corrected in nut :

Buffer overflow in the addchar function in common/parseconf.c in upsd in Network UPS Tools (NUT) before 2.6.4 allows remote attackers to execute arbitrary code or cause a denial of service (electric-power outage) via a long string containing non-printable characters (CVE-2012-2944).

The updated packages have been patched to correct this issue.

Sebastian Pohle discovered that Nut did not properly validate its input when receiving data over the network. If upsd was configured to allow connections over the network, a remote attacker could exploit this to cause a denial of service (application crash).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Networkupstools project reports :

NUT server (upsd), from versions 2.4.0 to 2.6.3, are exposed to crashes when receiving random data from the network.

This issue is related to the way NUT parses characters, especially from the network. Non printable characters were missed from strings operation (such as strlen), but still copied to the buffer, causing an overflow.

ID	Name	Product	Family	Severity
74730	openSUSE Security Update : nut (openSUSE-SU-2012:1069-1)	Nessus	SuSE Local Security Checks	high
64200	SuSE 11.1 Security Update : nuts (SAT Patch Number 6379)	Nessus	SuSE Local Security Checks	high
62361	GLSA-201209-19 : NUT: Arbitrary code execution	Nessus	Gentoo Local Security Checks	high
62004	SuSE 10 Security Update : nut (ZYPP Patch Number 8166)	Nessus	SuSE Local Security Checks	high
59762	Debian DSA-2484-1 : nut - denial of service	Nessus	Debian Local Security Checks	high
59660	Network UPS Tools < 2.6.4 addchar() Function Buffer Overflow	Nessus	Misc.	high
59513	Fedora 15 : nut-2.6.3-4.fc15 (2012-8747)	Nessus	Fedora Local Security Checks	high
59512	Fedora 16 : nut-2.6.3-4.fc16 (2012-8729)	Nessus	Fedora Local Security Checks	high
59511	Fedora 17 : nut-2.6.3-4.fc17 (2012-8694)	Nessus	Fedora Local Security Checks	high
59362	Mandriva Linux Security Advisory : nut (MDVSA-2012:087)	Nessus	Mandriva Local Security Checks	high
59320	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : nut vulnerability (USN-1456-1)	Nessus	Ubuntu Local Security Checks	high
59313	FreeBSD : nut -- upsd can be remotely crashed (47f13540-c4cb-4971-8dc6-28d0dabfd9cd)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2012-2944

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high