CVE-2024-52949: 
NixOS vulnerability analysis and mitigation

iptraf-ng version 1.2.1 contains a stack-based buffer overflow vulnerability. The vulnerability exists in src/ifaces.c, where the strcpy function fails to implement proper size control, allowing potential stack memory overflow (NVD, GitHub Release). The vulnerability was discovered and disclosed in December 2024.

The vulnerability is classified as a stack-based buffer overflow (CWE-120: Buffer Copy without Checking Size of Input). The issue specifically occurs in the src/ifaces.c file where the strcpy function consistently fails to control the buffer size. The vulnerability has received a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability allows an attacker to overflow memory on the stack, which can lead to arbitrary code execution with root privileges. This type of vulnerability can be exploited to gain unauthorized system access and potentially take complete control of the affected system (TIM Red Team).

The vulnerability can be exploited through a malicious configuration file. During security assessment, the vulnerability was discovered through fuzzing the -C argument with AFL++. The exploit allows for arbitrary code execution, and proof-of-concept code has demonstrated successful exploitation (TIM Red Team).

Users should upgrade to a version newer than 1.2.1 once available. As of the initial disclosure, no official patch has been released (GitHub Release).