CVE-2017-12893: Out-of-bounds Read (CWE-125)
value: The SMB/CIFS parser in tcpdump before 4.9.2 has a buffer over-read in smbutil.c:name_len().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: smbutil.c, tests/TESTLIST, tests/nbns-valgrind.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-12893/SMB/CIFS: Add a bounds check in name_len().

After we advance the pointer by the length value in the buffer, make
sure it points to something in the captured data.

This fixes a buffer over-read discovered by Forcepoint's security
researchers Otto Airamo & Antti Levomäki.

Add a test using the capture file supplied by the reporter(s).

Diff: diff --git a/smbutil.c b/smbutil.c
index b38d73af..fc9b3cc6 100644
--- a/smbutil.c
+++ b/smbutil.c
@@ -235,10 +235,11 @@ name_len(netdissect_options *ndo,
     while (*s) {
 	if (s >= maxbuf)
 	    return(-1);	/* name goes past the end of the buffer */
 	ND_TCHECK2(*s, 1);
 	s += (*s) + 1;
+	ND_TCHECK2(*s, 1);
     }
     return(PTR_DIFF(s, s0) + 1);
 
 trunc:
     return(-1);	/* name goes past the end of the buffer */
diff --git a/tests/TESTLIST b/tests/TESTLIST
index 5e3ea8d5..51407641 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -447,10 +447,13 @@ nfs-attr-oobr		nfs-attr-oobr.pcap		nfs-attr-oobr.out
 decnet-oobr		decnet-oobr.pcap		decnet-oobr.out
 
 # bad packets from Wilfried Kirsch
 slip-bad-direction	slip-bad-direction.pcap		slip-bad-direction.out	-ve
 
+# bad packets from Otto Airamo and Antti Levomäki
+nbns-valgrind		nbns-valgrind.pcap		nbns-valgrind.out	-vvv -e
+
 # RTP tests
 # fuzzed pcap
 rtp-seg-fault-1  rtp-seg-fault-1.pcap  rtp-seg-fault-1.out  -v -T rtp
 rtp-seg-fault-2  rtp-seg-fault-2.pcap  rtp-seg-fault-2.out  -v -T rtp
 
diff --git a/tests/nbns-valgrind.out b/tests/nbns-valgrind.out
new file mode 100644
index 00000000..bb9cc497
--- /dev/null
+++ b/tests/nbns-valgrind.out
@@ -0,0 +1,16 @@
+00:0c:85:0e:a5:ff > 00:00:0c:07:ac:f0, ethertype IPv4 (0x0800), length 92: (tos 0x0, ttl 127, id 38615, offset 0, flags [none], proto UDP (17), length 78)
+    10.49.248.228.137 > 10.48.161.241.137: 
+>>> NBT UDP PACKET(137): QUERY; REQUEST; UNICAST
+TrnID=0x8D40
+OpCode=0
+NmFlags=0x10
+Rcode=0
+QueryCount=1
+AnswerCount=0
+AuthorityCount=0
+AddressRecCount=0
+QuestionRecords:
+Name=
+WARNING: Short packet. Try increasing the snap length
+
+
diff --git a/tests/nbns-valgrind.pcap b/tests/nbns-valgrind.pcap
new file mode 100644
index 00000000..57657f02
Binary files /dev/null and b/tests/nbns-valgrind.pcap differ

Fixed code: 	ND_TCHECK2(*s, 1);
# bad packets from Otto Airamo and Antti Levomäki
nbns-valgrind		nbns-valgrind.pcap		nbns-valgrind.out	-vvv -e

00:0c:85:0e:a5:ff > 00:00:0c:07:ac:f0, ethertype IPv4 (0x0800), length 92: (tos 0x0, ttl 127, id 38615, offset 0, flags [none], proto UDP (17), length 78)
    10.49.248.228.137 > 10.48.161.241.137: 
>>> NBT UDP PACKET(137): QUERY; REQUEST; UNICAST
TrnID=0x8D40
OpCode=0
NmFlags=0x10
Rcode=0
QueryCount=1
AnswerCount=0
AuthorityCount=0
AddressRecCount=0
QuestionRecords:
Name=
WARNING: Short packet. Try increasing the snap length