bugtraq - Another tcpdump BGP infinite loop vulnerability (CAN-2005-1267)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050619091553.GB982@zaphod.nitro.dk>
Date: Sun, 19 Jun 2005 11:15:53 +0200
From: "Simon L. Nielsen" <simon@...eBSD.org>
To: bugtraq@...urityfocus.com
Subject: Another tcpdump BGP infinite loop vulnerability (CAN-2005-1267)

Hello

While working on the FreeBSD Security Advisory for the recent tcpdump
issues (CAN-2005-1278, CAN-2005-1279, and CAN-2005-1280) I noticed
another similar infinite loop DoS vulnerability in the BGP handling
code.  It affects at least tcpdump 3.8.3 and tcpdump 3.9 snapshots
from before May 5.

The problem was in bgp_update_print() in print-bgp.c around line 1652
(for tcpdump 3.8.3), where the -1 return value from decode_prefix4()
was not properly handled.

The issue was verified to cause an infinite loop against tcpdump 3.8.3
running on FreeBSD (before FreeBSD-SA-05:10.tcpdump), which included
the patches for the first set of tcpdump DoS vulnerabilities, and
against a Gentoo Linux with tcpdump-3.8.3-r2 (Gentoo has released an
update for GLSA-200505-06 which addresses the new issue).

The very ugly proof-of-concept exploit code, which is based on
bgp4_update.c from libnet, and the patch which fixes the problem
(based on part of print-bgp.c v. 1.95) can be found at the URL's
mentioned below.  The proof-of-concept has been tested on FreeBSD
using libnet 1.1.2.1.

Note that this issue has been public for a bit and most major vendors
has already release advisories for this issue, so this email is mainly
to have a reference for the issue.

This issue has been assigned the CVE name CAN-2005-1267.

http://people.freebsd.org/~simon/security/CAN-2005-1267/tcpdump-bgp-update-poc.c
http://people.freebsd.org/~simon/security/CAN-2005-1267/tcpdump-bgp-infinite-loop2.patch

-- 
Simon L. Nielsen

Content of type "application/pgp-signature" skipped