CVE-2014-5439
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code on systems running vulnerable versions of Sniffit network sniffer. By crafting a malicious configuration file, attackers can bypass multiple security protections (NX, SSP, ASLR) and gain root shell access. Anyone using Sniffit versions prior to 0.3.7 is affected.
💻 Affected Systems
- Sniffit
📦 What is this software?
Sniffit by Sniffit Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with root privileges leading to complete system compromise, data theft, and persistent backdoor installation.
Likely Case
Local privilege escalation to root shell for authenticated users who can write configuration files.
If Mitigated
Denial of service or limited information disclosure if exploit fails.
🎯 Exploit Status
Exploit requires local access to create malicious configuration file. Public exploit code available since 2014.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.3.7 and later
Vendor Advisory: No official vendor advisory found - Sniffit is open source.
Restart Required: No
Instructions:
1. Download Sniffit 0.3.7 or later from official source. 2. Compile and install new version. 3. Remove old vulnerable version.
🔧 Temporary Workarounds
Remove Sniffit
linuxUninstall Sniffit if not required
sudo apt-get remove sniffit
sudo yum remove sniffit
sudo make uninstall (if compiled from source)
Restrict configuration file permissions
linuxLimit who can create/modify Sniffit configuration files
sudo chmod 600 /etc/sniffit.conf
sudo chown root:root /etc/sniffit.conf
🧯 If You Can't Patch
- Remove Sniffit from production systems entirely
- Implement strict access controls on configuration files and directories
🔍 How to Verify
Check if Vulnerable:
Check Sniffit version: sniffit -v or which sniffit && ls -la /usr/bin/sniffitCheck Version:
sniffit -v 2>/dev/null || echo 'Sniffit not installed'Verify Fix Applied:
Verify version is 0.3.7 or higher: sniffit -v | grep -E '0\.3\.[7-9]|[0-9]\.[4-9]'📡 Detection & Monitoring
Log Indicators:
- Unusual configuration file modifications
- Sniffit process spawning shell processes
- Failed privilege escalation attempts
Network Indicators:
- Unexpected network sniffing activity
- Outbound connections from Sniffit process
SIEM Query:
process_name:sniffit AND (parent_process:bash OR cmdline:*sh*)🔗 References
- http://packetstormsecurity.com/files/129292/Sniffit-Root-Shell.html
- http://seclists.org/fulldisclosure/2014/Nov/88
- http://www.securityfocus.com/bid/71318
- http://packetstormsecurity.com/files/129292/Sniffit-Root-Shell.html
- http://seclists.org/fulldisclosure/2014/Nov/88
- http://www.securityfocus.com/bid/71318
