| Newsgroups |
gmane.linux.lfs.beyond.book |
| Message-ID |
<[email protected]> |
#23716: nmap-7.991
-------------------------+-------------------------
Reporter: Bruce Dubbs | Owner: Joe Locash
Type: enhancement | Status: closed
Priority: normal | Milestone: 13.1
Component: BOOK | Version: git
Severity: normal | Resolution: fixed
Keywords: |
-------------------------+-------------------------
Changes (by Joe Locash):
* resolution: => fixed
* status: assigned => closed
Comment:
{{{
Nmap 7.991 [2026-07-31]
o Fixed a memory-consumption hang in Ncat's HTTP proxy code that affected
both
connect and listen modes, reported by kumama_nui.
o Patched our included libssh2 source with upstream fixes for
CVE-2025-15661,
CVE-2026-7598, CVE-2026-55199, CVE-2026-55200, CVE-2026-58050, and
CVE-2026-58051. The version number has been annotated as 1.11.1_NMAP1
o [Zenmap][GH#3347] Fixed several issues leading to crashes when parsing,
editing, or saving command profiles containing '%' characters.
o [NSE][GH#2272] smb-enum-shares failed to produce output for valid shares
when
an error was encountered on one share.
o [GH#3410] Fixed an issue where DNS resolution would incorrectly fail to
match
the same name in a different case.
o [NSE][GH#1066] Added service names for SSL-protected services like
amt-soap-https to portrules for several scripts, ensuring they run on
these
as well as the standard unencrypted services.
o Audited and converted most instances of strcat, strcpy, and sprintf to
use
bounded functions instead.
o [NSE][GH#2221] mysql-dump-hashes now uses the correct column name for
MySQL 5.
7+
o [NSE][GH#2238] http-referer-checker was incorrectly fetching off-host
URLs.
Now only URLs on the target are fetched.
o [GH#2122] When an interface is specified with -e, also bind to the IP
address
for that device so that it works for non-Linux systems and non-root
users.
o [Nsock][GH#1939] When nsock_iod_set_localaddr() is used,
nsock_connect_*()
will now treat errors in bind(2) as connection failure.
o [GH#2732] Fix a potential crash on 32-bit platforms in debug mode due to
incorrect format specifier for 64-bit integer type. [Christopher Chavez]
o [GH#3201][GH#3367] Increase line length limit for nmap-service-probes
and
correctly handle lines that are too long. [@liquidpele, Ashutosh Kumar
Singh]
o [GH#3414] Avoid out-of-bounds read when parsing PTR domain names.
[@toor11 (Ju
ri)]
o [GH#2245] Ensure variables updated by signal handlers are volatile
sig_atomic_
t.
o [Ncat][GH#1410] Fix an assertion failure (count <= INT_MAX) in ncat -lk
in
some cases where stdin or a listening socket produces an error.
o [NSE][GH#1946] Fix a cryptic error in smb-enum-services, "Server
returned
less data than needed for header" when smb.start_smb() failed.
o Fixed an issue with parsing nmap-service-probes that could cause a
corrupted
file to crash Nmap. Reported by Muhammed Hussein.
o [NSE][GH#2016] Removed hostmap-bfk.nse, since the service it used shut
down.
o Fixed several issues reported by Himanshu Anand: infinite loop in TCP
options
parsing and out-of-bounds memory read in IPv4 OS detection; integer
underflow
in IPv6 extension header processing; and undefined behavior in DNS label
parsing.
o [GH#2721] Added checks for returned pointers from OpenSSL allocation
functions.
o [GH#1546] Fix an incorrect assertion "timeout / 1000 <= (long)
o.scan_delay"
in traceroute which failed for timeouts greater than 1 second when there
was
no scan delay.
o [GH#3175] The --stats-every option can now be used in conjunction with
--noninteractive. Previously, no stats messages were printed if a TTY
was not
attached.
o [GH#3375] Nmap can now be built with OpenSSL 4.0
o [Nping][GH#1751] The --rate option will not accept a rate higher than
1000
packets per second, since Nsock timers have millisecond resolution. Use
--delay 0 for unlimited rate.
o [Nping] Fixed several issues with Nping in IPv6 mode including:
+ [GH#1261] Incorrect BPF generated leading to "expression rejects all
packets"
+ [GH#3215] Incorrect constant used to check for IP version in Echo
Server
o [NSE][GH#3368] Fixed an out-of-memory issue in packet.lua when parsing a
zero-length TCP header option. [Maxim Suhanov]
o Fixed an issue where Nmap OS scan trusts a packet's ip_len to size a
CRC32
computation over TCP RST payload data, which may result in reading
arbitrary
heap data. Reported by Michael Bommarito.
o [Ncat][GH#3005] Correctly report listening port number. `ncat -l -p 0`
will
cause Ncat to listen on an ephemeral port, but it was reporting itself
as
listening on port 0.
o [Ncat][GH#1672] Fixed an issue where Ncat in server mode would quit
without
printing the last received data on a connection, particularly affecting
SCTP.
o [Ncat][GH#2827] Fixed an issue where Ncat in --send-only mode would
ignore
disconnects and crash when it tries to send data to a disconnected
client.
o [Ncat][GH#3291] Fixed an issue where Ncat on Windows would quit after 2
minutes due to an OS-enforced timeout on the half-open TCP socket used
to
emulate STDIN.
o [Nping][GH#564] Allow Nping to fall back to TCP Connect mode on Windows
when
Npcap is not installed.
o [Ncat] Fixed several issues reported by Muhammed Hussein involving
crashes in
Ncat's server-mode HTTP proxy, as well as one code-quality issue with
its
Telnet negotiation code.
o [Nsock][GH#2595] Fix an issue where Nsock's SOCKS4 proxy code would send
additional null bytes on Windows and other platforms where the compiler
does
not understand __attribute__((packed)). [Daniel Miller]
o The --release-memory option is now a no-op. Nmap will always run
finalization
routines that release allocated memory before closing.
o Fixed an integer underflow in service_scan.cc that would cause little-
endian
integers extracted from the beginning of a service banner to be
interpreted
as 0. Discovered with AFL++ by Malek Althubiany.
o [Nsock][GH#583] Use OpenSSL security levels and callbacks to prevent
errors
connecting to certain insecure targets when using NSOCK_SSL_MAX_SPEED.
The
default, as used in Ncat, now uses stricter-than-default security level.
o [GH#410] If a target times out due to --host-timeout, do not perform
traceroute.
o [Nping][GH#380] Disallow combining Ethernet-related options like --dest-
mac
with --send-ip
o [NSE][GH#3250][GH#3206] Fix assertion failures in cases where connect or
send
returns immediately with a status other than ERROR, e.g. TIMEOUT or
CANCELED.
[Daniel Miller]
o [Ncat][GH#290] Enable ncat -l --ssl to use DHE and ECDHE cipher suites
for
perfect forward secrecy.
o Fix a crash when writing long CPE strings to output. Reported by Harshit
Gupta. [Daniel Miller]
o [Ncat] Fix several cases where Ncat's SOCKS5 client could interpret
uninitialized data as protocol data, triggered by a malicious SOCKS5
proxy
server. No code execution or application crash is possible.
Reported by Govind Pratap Singh. [Daniel Miller]
o [Nping] Fix a out-of-bounds access in Nping Echo client allowing a
malicious Nping
EchoServer to zero 32 bytes of memory outside the packet buffer.
Reported by
Harshit Gupta. [Daniel Miller]
o Fix a 1-byte overrun (read) while reading certain crafted DNS labels,
reported by Peter Parker. [Daniel Miller]
o [NSE][GH#3317] Function url.build_path was mangling special characters
in URL
path segments. [nnposter]
}}}
Fixed at [sha:3beeccf30c].
--
Ticket URL: <https://wiki.linuxfromscratch.org/blfs/ticket/23716#comment:2>
BLFS Trac <https://wiki.linuxfromscratch.org/blfs/>
Beyond Linux From Scratch
--
http://lists.linuxfromscratch.org/sympa/info/blfs-book
Unsubscribe: See the above information page