【重要】关于IPTraf-ng CVE-2024-52949 安全漏洞的情况报告

尊敬的客户：

您好!

我公司观察到部分客户服务器存在IPTraf-ng CVE-2024-52949 安全漏洞，该漏洞攻击者利用缓冲区溢出，通常可以用来执行任意代码，获得目标服务器权限。

当前我公司对所有SaaS产品及项目产品进行核查后，认为：

部分服务器受影响。现已经进行修复

建议客户检查环境中其他系统是否受该漏洞影响。

晴讯科技     

2025年4月24日

附漏洞详情：

Vulnerability Description: Stack-based Buffer Overflow - CWE-121

Software Version: 1.2.1

NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-52949

CVSS:

Severity:

Credits: Massimiliano Ferraresi, Massimiliano Brolli

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Buffer overflows often can be used to execute arbitrary

Step-by-step instructions and PoC

During an assessment we fuzzed the -C argument with AFL++ with the following command

sudo ./afl-fuzz -i /in -o /out -- ./iptraf-ng -C @@

The /in directory contains various types of playlists that AFL can fuzz and iterate over. After one day of fuzzing, we found 4 types of config that crash iptraf-ng. The issue consistently occurs in the strcpy function doesn’t control the size and is possible to overflow memory in the stack