Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary code via crafted MPLS packets, as demonstrated by a long string in an ovs-appctl command.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:0537 advisory.

    Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote     per-flow control of traffic.

    Security Fix(es):

    * A buffer overflow flaw was discovered in the OVS processing of MPLS labels. A remote attacker able to     deliver a frame containing a malicious MPLS label that would be processed by OVS could trigger the flaw     and use the resulting memory corruption to cause a denial of service (DoS) or, possibly, execute arbitrary     code. (CVE-2016-2074)

    Red Hat would like to thank the Open vSwitch project for reporting this issue. Upstream acknowledges     Kashyap Thimmaraju and Bhargava Shastry as the original reporters.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated openvswitch packages that fix one security issue are now available for Red Hat OpenShift Enterprise 3.1.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.

A buffer overflow flaw was discovered in the OVS processing of MPLS labels. A remote attacker able to deliver a frame containing a malicious MPLS label that would be processed by OVS could trigger the flaw and use the resulting memory corruption to cause a denial of service (DoS) or, possibly, execute arbitrary code. (CVE-2016-2074)

Red Hat would like to thank the Open vSwitch Project for reporting these issues. Upstream acknowledges Kashyap Thimmaraju and Bhargava Shastry as the original reporters of CVE-2016-2074.

This update includes the following images :

openshift3/openvswitch:v3.1.1.6-9 aep3_beta/openvswitch:v3.1.1.6-9 openshift3/node:v3.1.1.6-16 aep3_beta/node:v3.1.1.6-16

All openvswitch users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

The version of Citrix XenServer running on the remote host is missing a security hotfix. It is, therefore, affected by multiple vulnerabilities.

The remote host is affected by the vulnerability described in GLSA-201701-07 (Open vSwitch: Remote execution of arbitrary code)

    A buffer overflow was discovered in lib/flow.c in ovs-vswitchd.
  Impact :

    A remote attacker, using a specially crafted MPLS packet, could execute       arbitrary code.
  Workaround :

    There is no known workaround at this time.

Open vSwitch reports :

Multiple versions of Open vSwitch are vulnerable to remote buffer overflow attacks, in which crafted MPLS packets could overflow the buffer reserved for MPLS labels in an OVS internal data structure. The MPLS packets that trigger the vulnerability and the potential for exploitation vary depending on version :

Open vSwitch 2.1.x and earlier are not vulnerable.

In Open vSwitch 2.2.x and 2.3.x, the MPLS buffer overflow can be exploited for arbitrary remote code execution.

In Open vSwitch 2.4.x, the MPLS buffer overflow does not obviously lead to a remote code execution exploit, but testing shows that it can allow a remote denial of service. See the mitigation section for details.

Open vSwitch 2.5.x is not vulnerable.

Kashyap Thimmaraju and Bhargava Shastry discovered a remotely triggerable buffer overflow vulnerability in openvswitch, a production quality, multilayer virtual switch implementation. Specially crafted MPLS packets could overflow the buffer reserved for MPLS labels in an OVS internal data structure. A remote attacker can take advantage of this flaw to cause a denial of service, or potentially, execution of arbitrary code.

ID	Name	Product	Family	Severity
210206	RHEL 7 : openvswitch (RHSA-2016:0537)	Nessus	Red Hat Local Security Checks	critical
119369	RHEL 7 : openvswitch (RHSA-2016:0615)	Nessus	Red Hat Local Security Checks	critical
108887	Citrix XenServer Multiple Vulnerabilities (CTX232655)	Nessus	Misc.	critical
96238	GLSA-201701-07 : Open vSwitch: Remote execution of arbitrary code	Nessus	Gentoo Local Security Checks	critical
91375	FreeBSD : openvswitch -- MPLS buffer overflow (b53bbf58-257f-11e6-9f4d-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	critical
90252	Debian DSA-3533-1 : openvswitch - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-2074

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical