nfdump 1.6.16 and earlier is affected by: Buffer Overflow. The impact is: The impact could range from a denial of service to local code execution. The component is: nfx.c:546, nffile_inline.c:83, minilzo.c (redistributed). The attack vector is: nfdump must read and process a specially crafted file. The fixed version is: after commit 9f0fe9563366f62a71d34c92229da3432ec5cf0e.

Two issues have been found in nfdump, a netflow capture daemon. Both issues are related to either a buffer overflow or an integer overflow, which could result in a denial of service or a local code execution.

For Debian 9 stretch, these problems have been fixed in version 1.6.15-3+deb9u1.

We recommend that you upgrade your nfdump packages.

For the detailed security status of nfdump please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/nfdump

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202003-17 (nfdump: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in nfdump. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by sending specially crafted netflow/sflow data,       could possibly execute arbitrary code with the privileges of the process       or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

2019-08-14

  - Fix compile issues

  - Fix output buffer size for lzo1x_decompress_safe()

2019-08-07

  - Fix VerifyExtensionMap #179

2019-08-06

  - Fix compile errors

2019-08-05

  - Fix nfdump.1 man page. #175

  - Fix off by 1 array. #173

  - Fix use after free in ModifyCompressFile

  - Add bound checks in AddExporterStat #174

  - Add bound checks in AddSamplerInfo #176

  - Add bound checks in AddExporterInfo

  - Fix checks in InsertExtensionMap #177

  - Remove COMPAT15 code - should no longer be needed.

  - Move version to v1.6.18

  - Merge pull request #167

  - Cleanup old code

  - Replace depricated pcap_lookupdev call in nfpcapd

2019-07-31

  - Add early record size sanity check also for nfprofile,     nfanon and nfreplay

2019-07-26

  - nfpcapd cleanup, add some more monitoring

  - Fix hbo_exporter.c:249_1 segfault 

  - Fix hbo_nffile_inline.c:85_1 segfault

  - Fix hbo_nfx.c:216_3 segfault

  - Update minilzo to v2.10

  - Change to safe lzo decompress function

2019-07-25

  - Rework nfpcapd and add it officially to the nfdump     collection.

  - Add nfpcapd man page

  - Fix potential unsigned integer underflow #171

2019-07-16

  - Add latency extension if dumping flowcache

2019-07-15

  - Fix typos

  - Fix exporter struct inconsistancies. Coredump on ARM     otherwise.

2019-07-02

  - Add ipfix element #150, #151 unix time start/end

  - Fix display bug raw record

2019-06-01

  - Add ipfix dyn element handling.

  - Add empty m4 directory - keep autoconf happy

2019-06-01

  - Fix issue #162 - ipfix mpls sequece.

  - Fix issue #156 - print flowtable index error

2019-03-17

  - Fix spec file

  - Remove non thread safe logging in nfpcapd

2018-11-24

  - Fix protocol tag for protocol 87 - TCF - #130

  - Add TCP flags ECN,CVR - #132

  - Fix some error messages to be printed to the correct     stream #135

  - Add missing -M command line help to nfcapd

  - Remove padding byte warning in log #141

  - Fix bug to accept -y compression flag in nfcapd. - #145

2018-06-24

  - Fix bookkeeper type - use key_t

  - Add multiple packet repeaters to nfcapd/sfcapd. Up to 8     repeaters (-R) can be defined.

  - Ignore OSX .DS_Store files in -R file list

  - Add CISCO ASA elements initiatorPackets (298)     responderPackets (299)

  - Merge #120 pull request for -z parameter to nfreplay

  - Update man page nfreplay

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
140809	Debian DLA-2383-1 : nfdump security update	Nessus	Debian Local Security Checks	high
134594	GLSA-202003-17 : nfdump: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
128134	Fedora 29 : nfdump (2019-9013b5e75d)	Nessus	Fedora Local Security Checks	high
128126	Fedora 30 : nfdump (2019-0fbfb00cbb)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2019-1010057

high

Tenable Plugins

high

high

high

high