CVE-2017-13004: Out-of-bounds Read (CWE-125)
value: The Juniper protocols parser in tcpdump before 4.9.2 has a buffer over-read in print-juniper.c:juniper_parse_header().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: print-juniper.c, tests/TESTLIST, tests/juniper_atm1.out, tests/juniper_es.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13004/Juniper: Add a bounds check.

This fixes a buffer over-read discovered by Forcepoint's security
researchers Otto Airamo & Antti Levomäki.

Add tests using the capture files supplied by the reporter(s).

Diff: diff --git a/print-juniper.c b/print-juniper.c
index e8879ea7b..ff1de9c03 100644
--- a/print-juniper.c
+++ b/print-juniper.c
@@ -1365,10 +1365,11 @@ juniper_parse_header(netdissect_options *ndo,
             }
 
             if (ndo->ndo_eflag) ND_PRINT((ndo, ": ")); /* print demarc b/w L2/L3*/
 
 
+            ND_TCHECK_16BITS(p+l2info->cookie_len);
             l2info->proto = EXTRACT_16BITS(p+l2info->cookie_len);
             break;
         }
         ++lp;
     }
diff --git a/tests/TESTLIST b/tests/TESTLIST
index 659827f81..c0a3f8dd8 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -491,10 +491,12 @@ pimv2-oobr-4		pimv2-oobr-4.pcap		pimv2-oobr-4.out		-vvv -e
 802_15_4-oobr-1		802_15_4-oobr-1.pcap		802_15_4-oobr-1.out	-vvv -e
 802_15_4-oobr-2		802_15_4-oobr-2.pcap		802_15_4-oobr-2.out	-vvv -e
 802_15_4-data		802_15_4-data.pcap		802_15_4-data.out	-vvv -e
 802_15_4_beacon		802_15_4_beacon.pcap		802_15_4_beacon.out	-vvv -e
 lmpv1_busyloop		lmpv1_busyloop.pcap		lmpv1_busyloop.out	-vvv -e
+juniper_atm1		juniper_atm1.pcap		juniper_atm1.out	-vvv -e
+juniper_es		juniper_es.pcap			juniper_es.out	-vvv -e
 
 # RTP tests
 # fuzzed pcap
 rtp-seg-fault-1  rtp-seg-fault-1.pcap  rtp-seg-fault-1.out  -v -T rtp
 rtp-seg-fault-2  rtp-seg-fault-2.pcap  rtp-seg-fault-2.out  -v -T rtp
diff --git a/tests/juniper_atm1.out b/tests/juniper_atm1.out
new file mode 100644
index 000000000..27f99bd00
--- /dev/null
+++ b/tests/juniper_atm1.out
@@ -0,0 +1,2 @@
+Out 
+	Juniper PCAP Flags [none]ATM1-PIC, cookie-len 4, cookie 0x30303030: [|juniper_hdr], length 808464432
diff --git a/tests/juniper_atm1.pcap b/tests/juniper_atm1.pcap
new file mode 100644
index 000000000..fc29d299a
Binary files /dev/null and b/tests/juniper_atm1.pcap differ
diff --git a/tests/juniper_es.out b/tests/juniper_es.out
new file mode 100644
index 000000000..e344d70ed
--- /dev/null
+++ b/tests/juniper_es.out
@@ -0,0 +1,2 @@
+Out 
+	Juniper PCAP Flags [none]ES-PIC, cookie-len 0: [|juniper_hdr], length 808464432
diff --git a/tests/juniper_es.pcap b/tests/juniper_es.pcap
new file mode 100644
index 000000000..8f28aa1fa
Binary files /dev/null and b/tests/juniper_es.pcap differ

Fixed code:             ND_TCHECK_16BITS(p+l2info->cookie_len);
juniper_atm1		juniper_atm1.pcap		juniper_atm1.out	-vvv -e
juniper_es		juniper_es.pcap			juniper_es.out	-vvv -e
Out 
	Juniper PCAP Flags [none]ATM1-PIC, cookie-len 4, cookie 0x30303030: [|juniper_hdr], length 808464432
Out 
	Juniper PCAP Flags [none]ES-PIC, cookie-len 0: [|juniper_hdr], length 808464432