Thomas Perale
3c305f32ba
Fixes the following vulnerability:
- CVE-2025-50681:
igmpproxy 0.4 before commit 2b30c36 allows remote attackers to cause a
denial of service (application crash) via a crafted IGMPv3 membership
report packet with a malicious source address. Due to insufficient
validation in the `recv_igmp()` function in src/igmpproxy.c, an
invalid group record type can trigger a NULL pointer dereference when
logging the address using `inet_fmtsrc()`. This vulnerability can be
exploited by sending malformed multicast traffic to a host running
igmpproxy, leading to a crash. igmpproxy is used in various embedded
networking environments and consumer-grade IoT devices (such as home
routers and media gateways) to handle multicast traffic for IPTV and
other streaming services. Affected devices that rely on unpatched
versions of igmpproxy may be vulnerable to remote denial-of-service
attacks across a LAN .
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-50681
- https://github.com/younix/igmpproxy/commit/2b30c36e6ab5b21defb76ec6458ab7687984484c
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
26 lines
890 B
Diff
26 lines
890 B
Diff
From 2b30c36e6ab5b21defb76ec6458ab7687984484c Mon Sep 17 00:00:00 2001
|
|
From: Jan Klemkow <j.klemkow@wemelug.de>
|
|
Date: Thu, 17 Apr 2025 19:02:16 +0200
|
|
Subject: [PATCH] Fix Buffer Overflow #97
|
|
|
|
CVE: CVE-2025-50681
|
|
Upstream: https://github.com/younix/igmpproxy/commit/2b30c36e6ab5b21defb76ec6458ab7687984484c
|
|
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
|
|
---
|
|
src/igmp.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/src/igmp.c b/src/igmp.c
|
|
index a80c4e58..838694ce 100644
|
|
--- a/src/igmp.c
|
|
+++ b/src/igmp.c
|
|
@@ -94,7 +94,7 @@ static const char *igmpPacketKind(unsigned int type, unsigned int code) {
|
|
case IGMP_V2_LEAVE_GROUP: return "Leave message ";
|
|
|
|
default:
|
|
- sprintf(unknown, "unk: 0x%02x/0x%02x ", type, code);
|
|
+ snprintf(unknown, sizeof unknown, "unk: 0x%02x/0x%02x ", type, code);
|
|
return unknown;
|
|
}
|
|
}
|