CVE-2019-1010142

Scapy 2.4.0 DoS via _RADIUSAttrPacketListField

• CVSS 7.5
• CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
• Resource Management
• Remote

scapy 2.4.0 is affected by: Denial of Service. The impact is: infinite loop, resource consumption and program unresponsive. The component is: _RADIUSAttrPacketListField.getfield(self..). The attack vector is: over the network or in a pcap. both work.

CVE

CVE-2019-1010142

CWE

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

CVSS base score

7.5

Published

2019-07-19

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update Scapy to version 2.4.2 or higher.

from scapy.all import *

class RADIUSAttrPacketListField(RADIUSAttrPacketListField):
    def getfield(self, pkt, s):
        return super().getfield(pkt, s)

class RADIUSPacket(RADIUS):
    attrs = RADIUSAttrPacketListField("attrs", None)

malformed_packet = RADIUSPacket(attrs=[("Malformed-Attribute", "test_user")])

from scapy.all import *

class ModifiedRADIUSAttrPacketListField(RADIUSAttrPacketListField):
    def getfield(self, pkt, s):
        try:
            return super().getfield(pkt, s)
        except Exception as e:
            print(f"Error processing RADIUS attributes: {e}")
            return None, s

class ModifiedRADIUSPacket(RADIUS):
    attrs = ModifiedRADIUSAttrPacketListField("attrs", None)

packet = ModifiedRADIUSPacket(attrs=[("User -Name", "test_user")])

@misc{vaitp:cve20191010142,
  title        = {{Scapy 2.4.0 DoS via _RADIUSAttrPacketListField}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2019},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2019-1010142},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2019-1010142/}}
}