Penetration Test Report (IncludeSecurity): Tcpdump Libpcap code review

Code Review Security Assessment of
Sponsored by Mozilla’s Secure Open Source program
Page 1 of 33
CONFIDENTIAL
DRAFT REPORT
TABLE OF CONTENTS
EXECUTIVE SUMMARY .................................................................................................................... 4
Scope and Methodology ........................................................................................................................... 4
Assessment Objectives .............................................................................................................................. 4
Findings Overview ..................................................................................................................................... 5
Next Steps ................................................................................................................................................. 5
ASSESSMENT RESULTS .................................................................................................................... 5
SECURITY AND RELIABILITY FINDINGS ............................................................................................ 6
F1: [libpcap] Remote Packet Capture Daemon (RPCAPD) Integer Overflow Leads to Heap Buffer
Overflow .................................................................................................................................................... 6
F2: [tcpdump] Integer Arithmetic Error can Lead to Heap Buffer Overflow When Processing Large Files
................................................................................................................................................................... 9
F3: [tcpdump] Out of Bounds Read Processing BGPTYPE_MP_REACH_NLRI Packets ............................ 11
F4: [tcpdump] Out of Bounds Read Processing IPv6 OSPF Packets ........................................................ 12
F5: [libpcap] Berkeley Packet Filter (BPF) Optimization Can Cause Stack Exhaustion ............................ 13
F6: [tcpdump] Out of Bounds Accesses in Server Message Block (SMB) Printer in print_trans2() ........ 14
F7: [tcpdump] Recursive Function Call Stack Exhaustion Processing SMB Packets in smb_fdata() ....... 15
F8: [tcpdump] Unsafe Integer Arithmetic Can Lead to Heap Overflow in linkaddr_string() .................. 16
F9: [tcpdump] Out of Memory Crashes via Various Memory Leaks in addrtoname.c ........................... 17
F10: [tcpdump] Stack Exhaustion Processing BGPTYPE_ATTR_SET Packets ........................................... 19
F11: [libpcap] Remote Packet Capture Daemon Multiple Authentication Improvements .................... 20
F12: [libpcap] Remote Packet Capture Daemon Null Pointer Dereference Denial of Service ................ 21
F13: [libpcap] Remote Packet Capture Daemon Allows Opening Capture URLs .................................... 22
INFORMATIONAL FINDINGS - FUTURE PROOFING AND DEFENSE IN DEPTH ............................... 24
I1: [tcpdump] Integer Truncation and Underflows in isis_print() ........................................................... 24
I2: [tcpdump] Out of bounds Pointer and Integer Overflow When Processing
BGPTYPE_MP_REACH_NLRI Packets ....................................................................................................... 26
I3: [tcpdump] Out of bounds Read Processing TUNNEL_SERVER_AUTH Packets .................................. 27
I4: [tcpdump] Security Warning During Configure Build Step ................................................................ 28
I5: [libpcap] Linux Ring Buffer Capture Mapped Writable ...................................................................... 29
Page 2 of 33
CONFIDENTIAL
DRAFT REPORT
I6: [tcpdump & libpcap] Multiple Memory Allocations Depend on the Result of Unchecked Arithmetic
................................................................................................................................................................. 29
I7: [libpcap] Berkeley Packet Filter (BPF) Processing May Read and Write Out of Bounds .................... 30
I8: [libpcap] Remote Packet Capture Daemon Parameter Reuse ........................................................... 31
I9: [tcpdump] Use of strcpy() on semi-trused data in ether_ntohost() .................................................. 32
Page 3 of 33
CONFIDENTIAL
DRAFT REPORT
EXECUTIVE SUMMARY
IncludeSec is an application security assessment focused consultancy founded by application
security veterans and past Defcon CTF winners in 2010. The team has delivered 600+ security
assessments for 145+ clients in 28+ programming languages privately reporting tens of
thousands of security issues to our clients to-date. The team works primarily with technology
oriented clients in the Silicon Valley, San Francisco, and New York City metro areas.
IncludeSec thanks Michael Richardson, François-Xavier LE BAIL, Denis Ovsienko, Guy Harris, and
the entire the tcpdump team for their assistance during the assessment process. Additionally
IncludeSec would like to thank Gervase Markham and the entire Mozilla team for defining this
project and sponsoring work to improve security of Open Source Software.
Scope and Methodology
IncludeSec performed a security assessment of the open source codebases for tcpdump &
libpcap as part of Mozilla’s Secure Open Source which allows for Free and Open Source
Software(FOSS) to be assessed for security with the overall goal of improving the security
posture of the Internet and the FOSS ecosystem. For this project the IncludeSec assessment
team was sponsored to execute a 10 day assessment effort spanning from Feb 5th – Feb 16th
2018. The team employed what is considered by IncludeSec to be a “Standard Code Review
Assessment Methodology.” The official open source releases as of Feb 2nd 2018 were reviewed.
Additionally the Mozilla team requested that the assessment be focused on manual code
review. Dynamic application security testing techniques such as fuzzing, automation tooling
such as static analysis, and creation of full proof of concept exploits were deemed out of scope
for this assessment. As such a detailed code review of the primary components described
above was executed as efficiently as possible in the allocated project time.
It should be noted that not all code was reviewed in the time allocated due to the time-boxed
nature of the assessment as the process of manual code review is time intensive. Thus no
guarantees of security or fitness can be provided as a result of this assessment process. That
being said, the assessment team feels this project yielded many interesting results which when
addressed will notably improve the security of tcpdump and libpcap.
Assessment Objectives
The objective of this assessment was to identify potential security vulnerabilities within the
primary components of tcpdump and lipcap. Although additional time was not allocated to
confirm exploitation via proof-of-concept exploits, the assessment team took it upon
themselves to create some PoC code to trigger traffic conditions which demonstrate a few of
the higher risk findings. The findings in the report below are in a suggested remediation priority
Page 4 of 33
CONFIDENTIAL
DRAFT REPORT
order. IncludeSec also provided remediation steps which the tcpdump team can use secure its
applications.
Findings Overview
IncludeSec identified 22 areas of improvement in the code base. Of these, 13 are suggested to
be addressed immediately and could pose a security or reliability risk. An additional nine
findings are informational in nature and recommended as future tactical and strategic
improvements to minimize the chances of future security problems arising in the applications
during future development.
Next Steps
IncludeSec advises the tcpdump team to remediate as many findings as possible in a prioritized
manner and implement as many changes to the application’s coding patterns to minimize the
chance of additional vulnerabilities being