hitoshura25/cvefixes huggingface dataset:
CVE-2017-13028 (Other, published 2017-09-14T06:29Z)
Description: value: The BOOTP parser in tcpdump before 4.9.2 has a buffer over-read in print-bootp.c:bootp_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-bootp.c
tests/TESTLIST
tests/bootp_asan.out
Commit message: CVE-2017-13028/BOOTP: Add a bounds check before fetching data

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't cause 'tcpdump: pcap_loop: truncated dump file'


Vulnerable code:

Fixed code:
	ND_TCHECK(bp->bp_flags);
bootp_asan		bootp_asan.pcap			bootp_asan.out		-v
IP (tos 0x0, ttl 252, id 40207, offset 0, flags [+, DF, rsvd], proto UDP (17), length 60951, bad cksum ff (->8336)!)
    18.0.0.15.16896 > 107.95.83.32.68: BOOTP/DHCP, unknown (0x00), length 59384, htype 0, hlen 0, hops 13, xid 0x14000000, secs 3328 [|bootp]
CVE-2017-13029 (Other, published 2017-09-14T06:29Z)
Description: value: The PPP parser in tcpdump before 4.9.2 has a buffer over-read in print-ppp.c:print_ccp_config_options().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-ppp.c
tests/TESTLIST
tests/ppp_ccp_config_deflate_option_asan.out
Commit message: CVE-2017-13029/PPP: Fix a bounds check, and clean up other bounds checks.

For configuration protocol options, use ND_TCHECK() and
ND_TCHECK_nBITS() macros, passing them the appropriate pointer argument.
This fixes one case where the ND_TCHECK2() call they replace was not
checking enough bytes.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.


Vulnerable code:
		ND_TCHECK2(*(p + 2), 3);
		ND_TCHECK2(*(p + 2), 2);
		ND_TCHECK2(*(p + 2), 4);
		ND_TCHECK2(*(p + 2), 2);
		ND_TCHECK2(*(p + 2), 2);
		ND_TCHECK2(*(p + 2), 4);
		ND_TCHECK2(*(p + 2), 2);
		ND_TCHECK2(*(p + 2), 2);
		ND_TCHECK2(*(p + 2), 2);
		ND_TCHECK2(*(p + 2), 1);
		ND_TCHECK2(*(p + 2), 1);
		ND_TCHECK2(*(p + 2), 1);
		ND_TCHECK2(*(p + 2), 4);

Fixed code:
		ND_TCHECK_24BITS(p + 2);
		ND_TCHECK_16BITS(p + 2);
		ND_TCHECK_32BITS(p + 2);
		ND_TCHECK_16BITS(p + 2);
		ND_TCHECK_16BITS(p+2);
		ND_TCHECK_32BITS(p + 2);
		ND_TCHECK_16BITS(p + 2);
		ND_TCHECK_16BITS(p + 2);
		ND_TCHECK_16BITS(p+2);
		ND_TCHECK(p[2]);
		ND_TCHECK(p[3]);
		ND_TCHECK(p[3]);
		ND_TCHECK_32BITS(p + 2);
ppp_ccp_config_deflate_option_asan	ppp_ccp_config_deflate_option_asan.pcap	ppp_ccp_config_deflate_option_asan.out	-v
: CCP, Conf-Request (0x01), id 223, length 125685
	encoded length 15 (=Option(s) length 11)
	  MVRCA Option (0x18), length 5[|ccp]
CVE-2017-13031 (Other, published 2017-09-14T06:29Z)
Description: value: The IPv6 fragmentation header parser in tcpdump before 4.9.2 has a buffer over-read in print-frag6.c:frag6_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-frag6.c
tests/TESTLIST
tests/ip6_frag_asan.out
Commit message: CVE-2017-13031/Check for the presence of the entire IPv6 fragment header.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.

Clean up some whitespace in tests/TESTLIST while we're at it.


Vulnerable code:
	ND_TCHECK(dp->ip6f_offlg);
pim_header_asan		pim_header_asan.pcap		pim_header_asan.out		-v
pim_header_asan-2	pim_header_asan-2.pcap		pim_header_asan-2.out		-v
pim_header_asan-3	pim_header_asan-3.pcap		pim_header_asan-3.out		-v

Fixed code:
	ND_TCHECK(*dp);
pim_header_asan		pim_header_asan.pcap		pim_header_asan.out	-v
pim_header_asan-2	pim_header_asan-2.pcap		pim_header_asan-2.out	-v
pim_header_asan-3	pim_header_asan-3.pcap		pim_header_asan-3.out	-v
ip6_frag_asan		ip6_frag_asan.pcap		ip6_frag_asan.out	-v
IP6 (class 0x51, flowlabel 0xb2100, hlim 16, next-header Fragment (44) payload length: 27136) 452:22:19:0:41a:e4ff:10ff:484d > 2243:80:1400:100:19:ffff:ffff:fffb: [|frag]
CVE-2017-13032 (Other, published 2017-09-14T06:29Z)
Description: value: The RADIUS parser in tcpdump before 4.9.2 has a buffer over-read in print-radius.c:print_attr_string().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-radius.c
tests/TESTLIST
tests/radius_attr_asan.out
Commit message: CVE-2017-13032/RADIUS: Check whether a byte exists before testing its value.

Reverse the test in a for loop to test the length before testing whether
we have a null byte.

This fixes a buffer over-read discovered by Bhargava Shastry.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.

Clean up other length tests while we're at it.


Vulnerable code:
           {
              ND_PRINT((ndo, "%s", tstr));
              return;
           }
              {
                 ND_PRINT((ndo, "%s", tstr));
                 return;
              }
   for (i=0; *data && i < length ; i++, data++)

Fixed code:
              goto trunc;
                 goto trunc;
           if (length < 1)
              goto trunc;
   for (i=0; i < length && *data; i++, data++)
radius_attr_asan	radius_attr_asan.pcap		radius_attr_asan.out	-v
IP (tos 0x64, ttl 249, id 40192, offset 0, flags [+, DF, rsvd], proto UDP (17), length 299, options (unknown 235 [bad length 252]), bad cksum 8000 (->1faa)!)
    0.0.86.32.258 > 0.2.250.99.3799: RADIUS, length: 263
	Unknown Command (58), id: 0x6a, Authenticator: 0901020ed7ff03edb63a0f00cb0f00cb
	  NAS-Port Attribute (5), length: 5, Value: ERROR: length 3 != 4
	  Unknown Attribute (127), length: 4, Value: 
	  NAS-IP-Address Attribute (4), length: 4, Value: ERROR: length 2 != 4
	  NAS-IP-Address Attribute (4), length: 4, Value: ERROR: length 2 != 4
	  NAS-IP-Address Attribute (4), length: 4, Value: ERROR: length 2 != 4
	  Callback-Id Attribute (20), length: 4, Value: .. [|radius]
CVE-2017-13034 (Other, published 2017-09-14T06:29Z)
Description: value: The PGM parser in tcpdump before 4.9.2 has a buffer over-read in print-pgm.c:pgm_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-pgm.c
tests/TESTLIST
tests/pgm_group_addr_asan.out
Commit message: CVE-2017-13034/PGM: Add a bounds check.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.

Move a return to make the code a bit cleaner (i.e., make it more obvious
that if we don't have enough of the PGM header, we just print the source
and destination IP addresses, mark it as incomplete PGM, and don't try
to look at the PGM header).


Vulnerable code:
			return;
			return;

Fixed code:
		return;
	    ND_TCHECK_16BITS(bp);
pgm_group_addr_asan	pgm_group_addr_asan.pcap	pgm_group_addr_asan.out	-v
IP (tos 0x41,ECT(1), id 40256, offset 0, flags [none], proto PGM (113), length 768, options (unknown 89 [bad length 232]), bad cksum 5959 (->5afd)!)
    89.121.89.107 > 89.89.89.89: 89.121.89.107.32322 > 89.89.89.89.500: PGM, length 24818 0x00ff7f010347 [|pgm]
CVE-2017-13035 (Other, published 2017-09-14T06:29Z)
Description: value: The ISO IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isis_print_id().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-isoclns.c
tests/TESTLIST
tests/isis_sysid_asan.out
Commit message: CVE-2017-13035/Properly handle IS-IS IDs shorter than a system ID (MAC address).

Some of them are variable-length, with a field giving the total length,
and therefore they can be shorter than 6 octets.  If one is, don't run
past the end.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.


Vulnerable code:
    for (i = 1; i <= SYSTEM_ID_LEN; i++) {

Fixed code:
    int sysid_len;
    sysid_len = SYSTEM_ID_LEN;
    if (sysid_len > id_len)
        sysid_len = id_len;
    for (i = 1; i <= sysid_len; i++) {
isis_sysid_asan		isis_sysid_asan.pcap		isis_sysid_asan.out	-v
UI 22! IS-IS, length 469869187
	L2 Lan IIH, hlen: 27, v: 1, pdu-v: 1, sys-id-len: 6 (0), max-area: 224 (224)
	  source-id: fed0.f90f.58af,  holding time: 34047s, Flags: [unknown circuit type 0x00]
	  lan-id:    0105.0088.a204.00, Priority: 65, PDU length: 4096
	    unknown TLV #64, length: 128
		0x0000:  ff10 8e12 0001 1b01 0000 6b00 fbcf f90f
		0x0010:  58af 84ff 1000 4901 0000 88a2 011c 000c
		0x0020:  0281 0083 1b01 0010 019d e000 fed0 f90f
		0x0030:  58af 84ff 1000 4101 0500 88a2 011c 0272
		0x0040:  0c2a 2205 831b 011c 0010 0000 0583 1b01
		0x0050:  0010 01ab e000 fe08 0808 0808 08cb 0808
		0x0060:  0808 0808 0808 0880 0008 7f08 0808 0808
		0x0070:  08fd 0808 080c 0608 0807 0808 0808 0408
	    Padding TLV #8, length: 8
	    Padding TLV #8, length: 8
	    Padding TLV #8, length: 7
	    Padding TLV #8, length: 8
	    Padding TLV #8, length: 0
	    Padding TLV #8, length: 8
	    unknown TLV #100, length: 0
	    unknown TLV #32, length: 16
		0x0000:  2020 2020 3c20 2020 2020 2020 205a 1a31
	    IS Neighbor(s) (variable length) TLV #7, length: 238
	      LAN address length 1 bytes 
		IS Neighbor: 5a
		IS Neighbor: 45
		IS Neighbor: 50
		IS Neighbor: 48
		IS Neighbor: 59
		IS Neighbor: 52
		IS Neighbor: 5f
		IS Neighbor: 43
		IS Neighbor: 54
		IS Neighbor: 4c
		IS Neighbor: 08
		IS Neighbor: 08
		IS Neighbor: 08
		IS Neighbor: 08
		IS Neighbor: 08
		IS Neighbor: 08
		IS Neighbor: 08
		IS Neighbor: 08
		IS Neighbor: 08
		IS Neighbor: 08
		IS Neighbor: 08
		IS Neighbor: 08
		IS Neighbor: 08
		IS Neighbor: 08
		IS Neighbor: 08
		IS Neighbor: 08
		IS Neighbor: 08
		IS Neighbor: 08
		IS Neighbor: 08
		IS Neighbor: 08
		IS Neighbor: 00
		IS Neighbor: 00
		IS Neighbor: 08
		IS Neighbor: 00
		IS Neighbor: 20
		IS Neighbor: 64
		IS Neighbor: 00
		IS Neighbor: 20
		IS Neighbor: 10
		IS Neighbor: 20
		IS Neighbor: 20
		IS Neighbor: 20
		IS Neighbor: 20
		IS Neighbor: 20
		IS Neighbor: 20
		IS Neighbor: 20
		IS Neighbor: 20 [|isis]
CVE-2017-13036 (Other, published 2017-09-14T06:29Z)
Description: value: The OSPFv3 parser in tcpdump before 4.9.2 has a buffer over-read in print-ospf6.c:ospf6_decode_v3().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-ospf6.c
tests/TESTLIST
tests/ospf6_decode_v3_asan.out
Commit message: CVE-2017-13036/OSPFv3: Add a bounds check before fetching data

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.


Vulnerable code:

Fixed code:
		ND_TCHECK_32BITS(&hellop->hello_options);
ospf6_decode_v3_asan	ospf6_decode_v3_asan.pcap	ospf6_decode_v3_asan.out -v
IP6 (class 0x76, flowlabel 0xf6701, hlim 109, next-header OSPF (89) payload length: 30311) 6767:6780:6767:a102:4:b6:5853:f040 > 1000:a32:8847:1::116: OSPFv3, Hello, length 30311
	Router-ID 1.1.0.34, Area 0.255.2.2, Instance 82 [|ospf3]
CVE-2017-13037 (Other, published 2017-09-14T06:29Z)
Description: value: The IP parser in tcpdump before 4.9.2 has a buffer over-read in print-ip.c:ip_printts().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-ip.c
tests/TESTLIST
tests/ip_ts_opts_asan.out
Commit message: CVE-2017-13037/IP: Add bounds checks when printing time stamp options.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.


Vulnerable code:
static void
		return;
			ip_printts(ndo, cp, option_len);

Fixed code:
static int
		return (0);
	ND_TCHECK(cp[2]);
	ND_TCHECK(cp[3]);
		ND_TCHECK2(cp[len], hoplen);
	return (0);

trunc:
	return (-1);
			if (ip_printts(ndo, cp, option_len) == -1)
				goto trunc;
ip_ts_opts_asan		ip_ts_opts_asan.pcap		ip_ts_opts_asan.out	-v
IP (tos 0xe2,ECT(0), id 32, offset 0, flags [+, DF, rsvd], proto ICMP (1), length 65319, options (timestamp TS{[bad length 14]TS+ADDR ^ 1229070338@0.0.52.112[|ip]), bad cksum a09b (->90a7)!)
    149.8.33.81 > 95.18.83.227: [|icmp]
CVE-2017-13038 (Other, published 2017-09-14T06:29Z)
Description: value: The PPP parser in tcpdump before 4.9.2 has a buffer over-read in print-ppp.c:handle_mlppp().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-ppp.c
tests/TESTLIST
tests/mlppp-oobr.out
Commit message: CVE-2017-13038/PPP: Do bounds checking.

This fixes a buffer over-read discovered by Brian 'geeknik' Carpenter.

Add a test using the capture file supplied by Katie Holly.


Vulnerable code:

Fixed code:
    if (length < 2) {
        ND_PRINT((ndo, "[|mlppp]"));
        return;
    }
    if (!ND_TTEST_16BITS(p)) {
        ND_PRINT((ndo, "[|mlppp]"));
        return;
    }

# bad packets from Katie Holly
mlppp-oobr		mlppp-oobr.pcap			mlppp-oobr.out

MLPPP, [|mlppp]
CVE-2017-13041 (Other, published 2017-09-14T06:29Z)
Description: value: The ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_nodeinfo_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-icmp6.c
tests/TESTLIST
tests/icmp6_nodeinfo_oobr.out
Commit message: CVE-2017-13041/ICMP6: Add more bounds checks.

This fixes a buffer over-read discovered by Kim Gwan Yeong.

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:

Fixed code:
		ND_TCHECK2(*dp, sizeof(*ni6));
			ND_TCHECK(cp[0]);
icmp6_nodeinfo_oobr	icmp6_nodeinfo_oobr.pcap	icmp6_nodeinfo_oobr.out
IP6 a072:7f00:1:7f00:1:e01a:17:6785 > c903::a002:8018:fe30:0:204: ICMP6, who-are-you reply[|icmp6], length 4
CVE-2017-13042 (Other, published 2017-09-14T06:29Z)
Description: value: The HNCP parser in tcpdump before 4.9.2 has a buffer over-read in print-hncp.c:dhcpv6_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-hncp.c
tests/TESTLIST
tests/hncp_dhcpv6data-oobr.out
Commit message: CVE-2017-13042/HNCP: add DHCPv6-Data bounds checks

hncp_print_rec() validates each HNCP TLV to be within the declared as
well as the on-the-wire packet space. However, dhcpv6_print() in the same
file didn't do the same for the DHCPv6 options within the HNCP
DHCPv6-Data TLV value, which could cause an out-of-bounds read when
decoding an invalid packet. Add missing checks to dhcpv6_print().

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:

Fixed code:
        if (i + 4 > length)
            return -1;
        if (i + 4 + optlen > length)
            return -1;
# The case below depends on the bug in print-hncp.c, which at the time of
# discovery had codepoints for DHCPv6-Data and DHCPv4-Data swapped around.
# After the bugfix the output will be different because of the different
# code path and will not test the vulnerability unless modified respectively.
# The .pcap file is truncated after the 1st packet.
hncp_dhcpv6data-oobr	hncp_dhcpv6data-oobr.pcap	hncp_dhcpv6data-oobr.out -v -c1
IP6 (flowlabel 0x01cc3, hlim 234, next-header UDP (17) payload length: 11025) 400::e4ff:ffff:adf9:8900:0.1646 > 62:9de3:ff47:ebec:8206:ff00:ad:ff00.8231: hncp (11017)
	Future use: type=16384 (5)
	DHCPv6-Data (25)
		Unknown (4)
		Unknown (4)
		SNTP-servers (61956)  (invalid)
	[|hncp]
CVE-2017-13043 (Other, published 2017-09-14T06:29Z)
Description: value: The BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:decode_multicast_vpn().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-bgp.c
tests/TESTLIST
tests/bgp_mvpn_6_and_7.out
Commit message: CVE-2017-13043/BGP: fix decoding of MVPN route types 6 and 7

RFC 6514 Section 4.6 defines the structure for Shared Tree Join (6) and
Source Tree Join (7) multicast VPN route types. decode_multicast_vpn()
didn't implement the Source AS field of that structure properly, adjust
the offsets to put it right.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:
            ND_TCHECK2(pptr[0], BGP_VPN_RD_LEN);
            pptr += BGP_VPN_RD_LEN;

Fixed code:
            ND_TCHECK2(pptr[0], BGP_VPN_RD_LEN + 4);
            pptr += BGP_VPN_RD_LEN + 4;
bgp_mvpn_6_and_7	bgp_mvpn_6_and_7.pcap		bgp_mvpn_6_and_7.out	-v -c1
IP (tos 0xc, ttl 254, id 21263, offset 0, flags [rsvd], proto TCP (6), length 517, bad cksum 8e15 (->99c9)!)
    241.0.93.20.179 > 255.247.0.1.200: Flags [none], seq 2146691977:2146692450, win 56026, options [unknown-161,eol], length 473: BGP
	Update Message (2), length: 45
	  Withdrawn routes: 3 bytes
	  Attribute Set (128), length: 7, Flags [OTPE+f]: 
	    Origin AS: 148
	      Multi-Protocol Reach NLRI (14), length: 71, Flags [T+6]: 
	    AFI: IPv4 (1), SAFI: Multicast VPN (5), nh-length: 0, no SNPA
	      Route-Type: Intra-AS I-PMSI (1), length: 0, RD: 62209:33686018 (= 2.2.2.2), Originator bogus address length 4294967232
	      Route-Type: Unknown (0), length: 0
	      Route-Type: Unknown (243), length: 1
	      Route-Type: Inter-AS I-PMSI (2), length: 2, RD: unknown RD format, Source-AS 368115805
	      Route-Type: Inter-AS I-PMSI (2), length: 2, RD: unknown RD format, Source-AS 335544320[|BGP]
CVE-2017-13044 (Other, published 2017-09-14T06:29Z)
Description: value: The HNCP parser in tcpdump before 4.9.2 has a buffer over-read in print-hncp.c:dhcpv4_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-hncp.c
tests/TESTLIST
tests/hncp_dhcpv4data-oobr.out
Commit message: CVE-2017-13044/HNCP: add DHCPv4-Data bounds checks

dhcpv4_print() in print-hncp.c had the same bug as dhcpv6_print(), apply
a fix along the same lines.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:

Fixed code:
        if (i + 2 > length)
            return -1;
        if (i + 2 + optlen > length)
            return -1;
# Same comments apply to the case below.
hncp_dhcpv4data-oobr	hncp_dhcpv4data-oobr.pcap	hncp_dhcpv4data-oobr.out -v -c1
IP truncated-ip - 260 bytes missing! (tos 0x12,ECT(0), ttl 48, id 21323, offset 0, flags [+, DF, rsvd], proto UDP (17), length 296, bad cksum 8e0f (->cd08)!)
    1.2.7.0.1812 > 128.253.0.96.8231: hncp (268)
	DHCPv4-Data (6)
		DNS-server (98) (invalid)
CVE-2017-13045 (Other, published 2017-09-14T06:29Z)
Description: value: The VQP parser in tcpdump before 4.9.2 has a buffer over-read in print-vqp.c:vqp_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-vqp.c
tests/TESTLIST
tests/vqp-oobr.out
Commit message: CVE-2017-13045/VQP: add some bounds checks

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:
    int tlen;

Fixed code:
#include "ether.h"
    u_int tlen;
    if (sizeof(struct vqp_common_header_t) > tlen)
        goto trunc;
        ND_TCHECK(*vqp_obj_tlv);
        if (sizeof(struct vqp_obj_tlv_t) > tlen)
            goto trunc;
        if (vqp_obj_len > tlen)
            goto trunc;
            if (vqp_obj_len != 4)
                goto trunc;
            if (vqp_obj_len != ETHER_ADDR_LEN)
                goto trunc;
vqp-oobr		vqp-oobr.pcap			vqp-oobr.out		-v -c1
IP (tos 0x0, ttl 17, id 40207, offset 0, flags [+, DF, rsvd], proto UDP (17), length 46, bad cksum 8f04 (->f897)!)
    0.0.128.20.1589 > 12.251.167.8.62720: 
	VQPv1, unknown (127) Message, error-code unknown (31) (31), seq 0x80f90000, items 27, length 18
	[|VQP]
CVE-2017-13046 (Other, published 2017-09-14T06:29Z)
Description: value: The BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:bgp_attr_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-bgp.c
tests/TESTLIST
tests/bgp_pmsi_tunnel-oobr.out
Commit message: CVE-2017-13046/BGP: fix an existing bounds check for PMSI Tunnel

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:
                ND_TCHECK2(tptr[0], 5);

Fixed code:
                ND_TCHECK2(tptr[0], 5);
bgp_pmsi_tunnel-oobr	bgp_pmsi_tunnel-oobr.pcap	bgp_pmsi_tunnel-oobr.out -v -c1
IP (tos 0x0, ttl 254, id 40207, offset 0, flags [+, DF, rsvd], proto TCP (6), length 296, bad cksum 8e15 (->3eaa)!)
    241.0.32.19.179 > 239.0.0.1.0: Flags [none], seq 2146695561:2146695813, win 56026, options [unknown-161,eol], length 252: BGP
	Update Message (2), length: 45
	  Withdrawn routes: 3 bytes
	  Attribute Set (128), length: 7, Flags [OTPE+f]: 
	    Origin AS: 4067
	      Origin (1), length: 1EGP
	      Unknown Attribute (19), length: 1, Flags [+1]: 
	    no Attribute 19 decoder
	    0x0000:  01
	      PMSI Tunnel (22), length: 1, Flags [+1]: [|BGP]