lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 2 Jul 2018 18:48:40 +0100
From: Ioannis Profetis <>
Subject: [FD] ntop-ng < 3.4.180617 - Authentication bypass / session

ntop-ng Authentication bypass (CVE-2018-12520)

# Product Details

ntopng is the next generation version of the original ntop, a network
traffic probe that shows the network usage, similar to what the popular top
Unix command does. ntopng is based on libpcap and it has been written in a
portable way in order to virtually run on every Unix platform, MacOSX and
on Windows as well.
# Vulnerability Details
An issue was discovered in ntopng 3.4.
The PRNG involved in the generation of session IDs is not seeded at program
This results in deterministic session IDs being allocated for active user
sessions. An attacker with foreknowledge of the operating system and
standard library in use by the host running the service and the username of
the user whose session they're targeting can abuse the deterministic random
number generation in order to hijack the user's session, thus escalating
their access.

# Exploit
A proof-of-concept for this vulnerability can be found at Note
that this script has been tested with Python 2.7, and requires the
'requests' module, which can be found in the Python Package Index.

# Mitigation
Upgrade to the latest stable version of ntop-ng 3.4.

# Attack Type
Remote, Unauthenticated, Escalation of Privileges, Information Disclosure

# Advisory Timeline
17/06/2018 - Reported issue to ntop-ng security team, received CVE
allocation (CVE-2018-12520), vendor acknowledged the issue and issued a
patch/updated their package repository with a patched version of the
02/07/2018 - Full Disclosure

# References

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists