CVE-2017-13688 (Other, published 2017-09-14T06:29Z)
Description: value: The OLSR parser in tcpdump before 4.9.2 has a buffer over-read in print-olsr.c:olsr_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-olsr.c
tests/TESTLIST
tests/olsr-oobr-1.out
tests/olsr-oobr-2.out
Commit message: CVE-2017-13688/OLSR: Do bounds checks before we fetch data.

While we're at it, clean up some other bounds checks, so we check that
we have a complete IPv4 message header if it's IPv4 and a complete IPv6
message header if it's IPv6.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add tests using the capture files supplied by the reporter(s).


Vulnerable code:
        ND_TCHECK2(*tptr, sizeof(struct olsr_msg4));

            u_int name_entries = EXTRACT_16BITS(msg_data+2);
            u_int addr_size = 4;
            int name_entries_valid = 0;
            if (msg_tlen < 4)
                goto trunc;
            ND_TCHECK2(*msg_data, 4);


Fixed code:
            ND_TCHECK2(*tptr, sizeof(struct olsr_msg6));
            ND_TCHECK2(*tptr, sizeof(struct olsr_msg4));
            u_int name_entries;
            u_int addr_size;
            int name_entries_valid;
            if (msg_tlen < 4)
                goto trunc;
            ND_TCHECK2(*msg_data, 4);

            name_entries = EXTRACT_16BITS(msg_data+2);
            addr_size = 4;
            name_entries_valid = 0;
olsr-oobr-1		olsr-oobr-1.pcap		olsr-oobr-1.out	-v
olsr-oobr-2		olsr-oobr-2.pcap		olsr-oobr-2.out	-v
IP truncated-ip - 2315 bytes missing! (tos 0x0, ttl 18, id 4111, offset 0, flags [+, DF, rsvd], proto UDP (17), length 5373, bad cksum 8e7f (->9764)!)
    15.251.128.192.698 > 193.192.186.0.122: OLSRv4, seq 0x0800, length 2056
	Nameservice Message (0x82), originator 126.198.193.192, ttl 26, hop 145
	  vtime 0.062s, msg-seq 0x0008, length 127[|olsr]
IP truncated-ip - 2315 bytes missing! (tos 0x0, ttl 18, id 4111, offset 0, flags [+, DF, rsvd], proto UDP (17), length 5373, bad cksum 8e7f (->975f)!)
    16.0.128.192.698 > 193.192.186.0.122: OLSRv4, seq 0x0400, length 512
	Powerinfo Message (0x80), originator 0.1.0.0, ttl 255, hop 255
	  vtime 0.500s, msg-seq 0x0000, length 9216 (invalid)
IP truncated-ip - 2315 bytes missing! (tos 0x0, ttl 18, id 4111, offset 0, flags [+, DF, rsvd], proto UDP (17), length 5373, bad cksum 8e7f (->9764)!)
    15.251.128.192.698 > 193.192.186.0.122: OLSRv4, seq 0x0800, length 2056
	Nameservice Message (0x82), originator 126.198.193.192, ttl 26, hop 145
	  vtime 0.062s, msg-seq 0x0008, length 100[|olsr]
IP truncated-ip - 2315 bytes missing! (tos 0x0, ttl 18, id 4111, offset 0, flags [+, DF, rsvd], proto UDP (17), length 5373, bad cksum 8e7f (->975f)!)
    16.0.128.192.698 > 193.192.186.0.122: OLSRv4, seq 0x0800, length 2056
	Nameservice Message (0x82), originator 126.198.193.192, ttl 26, hop 145
	  vtime 0.062s, msg-seq 0x5c50, length 185[|olsr]
[|ether]
[|ether]
IP6 (flowlabel 0x06400, hlim 0, next-header UDP (17) payload length: 5401) 0:24::1e:a0a:141e.698 > 38fd:7f49:eaff:ffff:2025:7373:7562:2573.2: OLSRv6, seq 0x0201, length 5393[|olsr]