CVE-2020-15471
📋 TL;DR
CVE-2020-15471 is a heap-based buffer over-read vulnerability in nDPI's packet parsing code that could allow attackers to read sensitive memory contents or cause denial of service. This affects systems using nDPI versions through 3.2 for deep packet inspection. Network monitoring tools and security appliances incorporating nDPI are potentially vulnerable.
💻 Affected Systems
- nDPI
- ntopng
- PF_RING
- other products using nDPI library
📦 What is this software?
Ndpi by Ntop
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, though buffer over-read typically enables information disclosure or crashes
Likely Case
Denial of service through application crashes or information disclosure of adjacent memory contents
If Mitigated
Limited impact with proper network segmentation and exploit mitigations like ASLR
🎯 Exploit Status
Exploitation requires sending specially crafted network packets to systems using nDPI
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: nDPI 3.3 and later
Vendor Advisory: https://github.com/ntop/nDPI/security/advisories
Restart Required: Yes
Instructions:
1. Update nDPI to version 3.3 or later. 2. Recompile any applications using nDPI. 3. Restart affected services. 4. Verify the commit 61066fb106efa6d3d95b67e47b662de208b2b622 is included.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to systems using nDPI to trusted sources only
Disable nDPI Processing
linuxTemporarily disable nDPI deep packet inspection if not critical
# Configuration dependent - consult application documentation
🧯 If You Can't Patch
- Implement strict network ACLs to limit packet sources
- Deploy exploit mitigations like ASLR and stack canaries
🔍 How to Verify
Check if Vulnerable:
Check nDPI version: ndpi --version or check library version in applicationsCheck Version:
ndpi-config --version || strings /usr/lib/libndpi.so | grep 'nDPI version'Verify Fix Applied:
Verify nDPI version is 3.3+ and commit 61066fb106efa6d3d95b67e47b662de208b2b622 is present📡 Detection & Monitoring
Log Indicators:
- Application crashes
- Memory access violation errors
- Unexpected process termination
Network Indicators:
- Malformed packets targeting nDPI ports
- Unusual packet patterns to monitoring systems
SIEM Query:
process_name:nDPI AND (event_type:crash OR error_message:"buffer over-read" OR error_code:SIGSEGV)