{"uuid": "94456fe4-bbf9-4c3b-86fb-7f27a4fd7ad1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-1428", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/vpn/tincd_bof.rb", "content": "{\"aliases\": [], \"arch\": \"x86, cmd, armle\", \"author\": [\"Tobias Ospelt\", \"Martin Schobert\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a stack buffer overflow in Tinc's tincd\\n          service. After authentication, a specially crafted tcp packet (default port 655)\\n          leads to a buffer overflow and allows to execute arbitrary code. This module has\\n          been tested with tinc-1.1pre6 on Windows XP (custom calc payload) and Windows 7\\n          (windows/meterpreter/reverse_tcp), and tinc version 1.0.19 from the ports of\\n          FreeBSD 9.1-RELEASE # 0 and various other OS, see targets. The exploit probably works\\n          for all versions <= 1.1pre6.\\n          A manually compiled version (1.1.pre6) on Ubuntu 12.10 with gcc 4.7.2 seems to\\n          be a non-exploitable crash due to calls to __memcpy_chk depending on how tincd\\n          was compiled. Bug got fixed in version 1.0.21/1.1pre7. While writing this module\\n          it was recommended to the maintainer to start using DEP/ASLR and other protection\\n          mechanisms.\", \"disclosure_date\": \"2013-04-22\", \"fullname\": \"exploit/multi/vpn/tincd_bof\", \"is_install_path\": true, \"mod_time\": \"2025-06-23 12:43:46 +0000\", \"name\": \"Tincd Post-Authentication Remote TCP Stack Buffer Overflow\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/multi/vpn/tincd_bof.rb\", \"platform\": \"BSD,Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 200, \"ref_name\": \"multi/vpn/tincd_bof\", \"references\": [\"CVE-2013-1428\", \"OSVDB-92653\", \"BID-59369\", \"URL-http://www.floyd.ch/?p=741\", \"URL-http://sitsec.net/blog/2013/04/22/stack-based-buffer-overflow-in-the-vpn-software-tinc-for-authenticated-peers/\"], \"rport\": 655, \"session_types\": false, \"targets\": [\"Windows XP x86, tinc 1.1.pre6 (exe installer)\", \"Windows 7 x86, tinc 1.1.pre6 (exe installer)\", \"FreeBSD 9.1-RELEASE # 0 x86, tinc 1.0.19 (ports)\", \"Fedora 19 x86 ROP (NX), write binary to disk payloads, tinc 1.0.20 (manual compile)\", \"Fedora 19 x86 ROP (NX), CMD exec payload, tinc 1.0.20 (manual compile)\", \"Archlinux 2013.04.01 x86, tinc 1.0.20 (manual compile)\", \"OpenSuse 11.2 x86, tinc 1.0.20 (manual compile)\", \"Pidora 18 ARM ROP(NX)/ASLR brute force, write binary to disk payloads, tinc 1.0.20 (manual compile with restarting daemon)\", \"Pidora 18 ARM ROP(NX)/ASLR brute force, CMD exec payload, tinc 1.0.20 (manual compile with restarting daemon)\", \"Crash only: Ubuntu 12.10 x86, tinc 1.1.pre6 (apt-get or manual compile)\", \"Crash only: Fedora 16 x86, tinc 1.0.19 (yum)\", \"Crash only: OpenSuse 11.2 x86, tinc 1.0.16 (rpm package)\", \"Crash only: Debian 7.3 ARM, tinc 1.0.19 (apt-get)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:29.056893Z"}