Network UPS Tools (NUT) 'addchar () 'Function Buffer Overflow Vulnerability

Release date:
Updated on: 2012-06-01

Affected Systems:
Eaton Network UPS Tools (NUT) 2.6.3
Unaffected system:
Eaton Network UPS Tools (NUT) 2.6.4
Description:
--------------------------------------------------------------------------------
Bugtraq id: 53743
CVE (CAN) ID: CVE-2012-2944

The Network UPS Tools (NUT) project provides support for power supply equipment, including many control and monitoring functions, with unified control and management interfaces.

In versions earlier than Network UPS Tools (NUT) 2.6.4, when parsing unprintable characters, common/parseconf. the "addchar ()" function in c has an input verification error, which can be exploited to cause buffer overflow and arbitrary code execution.

<* Source: Sebastian Pohle

Link: http://trac.networkupstools.org/projects/nut/changeset/3633
Http://secunia.com/advisories/49348/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Eaton
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://download.mgeops.com/explore/eng/network/net_sol.htm