Bug in vde_plug, remote exploitation possible?

[halfdog <me () halfdog net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Vde (virtual distributed ethernet) is an ethernet compliant virtual network that
can be spawned over a set of physical computers over the internet ... (see
http://vde.sourceforge.net).

The vde_plug (at least on ubuntu hardy) contains a bug, that is triggered when a
certain amount of encapsulated ether frame data is sent to the plug in a
specially timed manner. When the input buffer is filled just with a single byte,
vde_plug uses also the first byte after the end of data, thus constructing an
invalid frame length. Depending on frame length, just one byte or the complete
buffer content is discarded, thus leading to lost single
byte or complete frame content.

See http://www.halfdog.net/Security/VdeNetBufferBug/ for more information.

It is very simple to trigger the bug by sending data directly to the vde_plug,
but I am searching for a way to trigger the bug using only data in transit. Has
someone an idea why the test program fails to trigger the bug?

Does someone know, in which software products the vde_plug component might be
included (virtualbox??)?

- -- 
http://www.halfdog.net/
PGP: 156A AE98 B91F 0114 FE88  2BD8 C459 9386 feed a bee
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFMgAAfxFmThv7tq+4RAvh6AJ9zLZuoHOUckla8/l0fw2IhW+88KgCfexMw
OpIRWhGncz01jFXGw/kxtMc=
=8PpB
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/