CVE-2017-11668

Vulnerability

An out-of-bounds read vulnerability exists in the assess_packet function in eapmd5pass.c:134 of eapmd5pass version 1.4. The flaw occurs when the software processes specially crafted network packets, leading to a read beyond the allocated memory buffer. This bug was discovered by Dhiru Kholia using libFuzzer and reported on the oss-security mailing list [1]. The affected version is eapmd5pass 1.4, as shipped with Kali Linux [1].

Exploitation

A remote attacker can exploit this vulnerability by sending a specially crafted network packet to the eapmd5pass process. The attacker does not require any authentication or prior access to the target system. The exploit triggers the out-of-bounds read in the assess_packet function when eapmd5pass handles the malicious traffic [1]. No user interaction is needed beyond the process receiving the packet.

Impact

Successful exploitation causes eapmd5pass to crash, resulting in a denial of service (DoS). The attacker can disrupt the intended functionality of the software, but the impact is limited to a remote crash; there is no evidence of code execution or information disclosure in the available references [1]. The crash is the direct consequence of the out-of-bounds read.

Mitigation

As of the publication date (2017-07-31), no official fix or patched version has been released by the maintainers. The upstream software appears to be unmaintained, and users are advised to avoid running eapmd5pass in production or untrusted environments until a patch is available. No workaround is documented in the references. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog [1].