netdiscover segfaults when looking up vendors

[Deniz Adrian]

Binary package hint: netdiscover

search_vendor tries to write into tmac[6], which should be tmac[7], overflows.

patch attached.

[Deniz Adrian (deniz-adrianer)]

don't know if this may be exploitable by sending some weird MAC-addresses over the wire, so set this to "security-related"

[Deniz Adrian (deniz-adrianer)]

this could be the same as #275106 and/or #291005. sorry for double-posting

[Jamie Strandboge (jdstrand)]

I looked at misc.c on Hardy and don't see the problem. What version of netdiscover are you using and can you give an example that triggers this condition?

[Jamie Strandboge (jdstrand)]

Oh, I didn't look far enough. While sprintf doesn't write too much, and the for loop doesn't access beyond the end, tmac isn't null-terminated, which could cause strcmp to fail (it expects null terminated strings).

[Eriberto (eriberto)]

Hi,

I am the new maintainer of the netdiscover in Debian.

I am closing this bug, already fixed in a previous version/revision.

Regards,

Eriberto