FYI:

As Alan Coopersmith just said, oss-security is a public mailing list.
You would need to have emailed only individual persons and private
mailing lists (like [email protected] and Mr Butskoy) related to the
development and distribution of the program in question for this to
have been coordinated disclosure. The public message to
[email protected] would then need to be posted in July,
not this month.

Remember that for the next vulnerability you try to do coordinated
disclosure for.

On Tue, 28 Apr 2026 23:03:58 +0100
MOHAMED AZIZ RAHMOUNI <[email protected]> wrote:

> Hello,
> 
> I am reporting a security vulnerability I discovered in traceroute
> 2.1.2 during manual code review and dynamic fuzzing.
> 
> Summary:
> An out-of-bounds read exists in traceroute/traceroute.c. After
> recvmsg() returns, bufp is advanced past the IPv4 header (bufp +=
> hlen) but n is not decremented accordingly. The subsequent call:
> 
>     handle_extensions(pb, bufp + offs, n - offs, step);
> 
> passes a len value that is hlen bytes (20 for IPv4, 40 for IPv6)
> larger than the actual data available from bufp + offs. This causes
> the MPLS extension parser to read past the received packet boundary
> into uninitialized stack memory within buf[1280].
> 
> The vulnerability is remotely triggerable by any on-path network
> device that can send a crafted ICMP Time Exceeded response with MPLS
> extensions to a traceroute -e invocation. I have confirmed the issue
> with a working proof of concept.
> 
> Proposed fix (single line addition after line 1427):
> 
>     bufp += hlen;
>     n -= hlen;   // add this line
> 
> I have attached a full technical report including root cause analysis,
> proof of concept code, memory layout analysis, and impact assessment.
> 
> Please confirm receipt of this report.
> 
> Regards,
> Security researcher Zyyz
> 
> Mohamed Aziz Rahmouni



-- 
Ellenor et al Bjornsdottir, sysadmin umbrellix.net.

This is my laptop, and as such I might be on the go; by the time you
get this message I could already be back on my bike.

Please consider the environment before you ask an AI to summarize this
email or write me a response. 

Reply via email to