CVE-2013-1428

What it actually does

Stack-based buffer overflow in receive_tcppacket allows an authenticated remote peer to supply an oversized TCP packet that overwrites the stack, leading to process crash or arbitrary code execution.

Why it matters to the business

Compromise or disruption of VPN nodes can break encrypted site-to-site or remote-access tunnels, exposing internal traffic or causing extended outages in environments still running unpatched tinc versions.

How an attack unfolds

An attacker who has already established a valid tinc peer relationship crafts and sends a single large TCP packet to the receive_tcppacket handler; the missing bounds check triggers the overflow, allowing control-flow hijacking or denial of service.

How to fix it

Upgrade tinc to version 1.0.21 or 1.1pre7 (or later releases) on all nodes; disable or isolate any nodes that cannot be updated immediately.

How to confirm the fix worked

Run 'tinc --version' on each node and confirm the reported version meets or exceeds 1.0.21 / 1.1pre7; re-test connectivity after upgrade and monitor for unexpected restarts.

Typical attack path

1. Obtain or compromise a valid tinc peer certificate/key
2. Establish a TCP connection to a target tinc node
3. Transmit a crafted packet exceeding the expected size in net_packet.c
4. Trigger stack overwrite to crash the daemon or execute shellcode

How to detect it

Review tinc daemon logs and system crash reports for sudden terminations around the time of large inbound TCP packets from authenticated peers; correlate with net_packet.c related stack traces if core dumps are available.

What your security team should do

• Inventory all tinc deployments and prioritize patching of any instance older than 1.0.21 or 1.1pre7
• Restrict peer authentication to trusted endpoints only and consider network-level controls until patches are applied
• Monitor process crash logs and unusual restarts on tinc hosts