-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Vde (virtual distributed ethernet) is an ethernet compliant virtual network that can be spawned over a set of physical computers over the internet ... (see http://vde.sourceforge.net).
The vde_plug (at least on ubuntu hardy) contains a bug, that is triggered when a certain amount of encapsulated ether frame data is sent to the plug in a specially timed manner. When the input buffer is filled just with a single byte, vde_plug uses also the first byte after the end of data, thus constructing an invalid frame length. Depending on frame length, just one byte or the complete buffer content is discarded, thus leading to lost single byte or complete frame content. See http://www.halfdog.net/Security/VdeNetBufferBug/ for more information. It is very simple to trigger the bug by sending data directly to the vde_plug, but I am searching for a way to trigger the bug using only data in transit. Has someone an idea why the test program fails to trigger the bug? Does someone know, in which software products the vde_plug component might be included (virtualbox??)? - -- http://www.halfdog.net/ PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFMgAAfxFmThv7tq+4RAvh6AJ9zLZuoHOUckla8/l0fw2IhW+88KgCfexMw OpIRWhGncz01jFXGw/kxtMc= =8PpB -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
