hitoshura25/cvefixes huggingface dataset:
CVE-2017-12896 (Other, published 2017-09-14T06:29Z)
Description: value: The ISAKMP parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:isakmp_rfc3948_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
tests/TESTLIST
tests/isakmp-3948-oobr-2.out
Commit message: CVE-2017-12896/ISAKMP: Add another test.

This is from Brian Carpenter for the print-isakmp bug fix.


Vulnerable code:

Fixed code:
isakmp-3948-oobr-2	isakmp-3948-oobr-2.pcap		isakmp-3948-oobr-2.out
IP 48.48.48.48.4500 > 48.48.48.48.12336: [|isakmp]
CVE-2017-12899 (Other, published 2017-09-14T06:29Z)
Description: value: The DECnet parser in tcpdump before 4.9.2 has a buffer over-read in print-decnet.c:decnet_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
tests/TESTLIST
tests/decnet-shorthdr-oobr.out
Commit message: CVE-2017-12899/DECnet: Add another test.

This is from Brian Carpenter for the print-decnet bug fix.


Vulnerable code:

Fixed code:
decnet-shorthdr-oobr	decnet-shorthdr-oobr.pcap	decnet-shorthdr-oobr.out
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030                                0000
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030                                0000
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030                                0000
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030                                0000
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030                                0000
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030                                0000
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030                                0000
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030                                0000
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030                                0000
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030                                0000
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030                                0000
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030                                0000
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030                                0000
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030                                0000
[|decnet]
CVE-2017-12899 (Other, published 2017-09-14T06:29Z)
Description: value: The DECnet parser in tcpdump before 4.9.2 has a buffer over-read in print-decnet.c:decnet_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-decnet.c
tests/TESTLIST
tests/decnet-oobr.out
Commit message: CVE-2017-12899/DECnet: Fix bounds checking.

If we're skipping over padding before the *real* flags, check whether
the real flags are in the captured data before fetching it.  This fixes
a buffer over-read discovered by Kamil Frankowicz.

Note one place where we don't need to do bounds checking as it's already
been done.

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:

Fixed code:
	    ND_TCHECK(rhp->rh_short.sh_flags);
	/* Our caller has already checked for mflags */
decnet-oobr		decnet-oobr.pcap		decnet-oobr.out
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0010:  3030 3030                                0000
MEDSA 16.6:48: [|decnet]
CVE-2017-12902 (Other, published 2017-09-14T06:29Z)
Description: value: The Zephyr parser in tcpdump before 4.9.2 has a buffer over-read in print-zephyr.c, several functions.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-zephyr.c
tests/TESTLIST
tests/zephyr-oobr.out
Commit message: CVE-2017-12902/Zephyr: Fix bounds checking.

Use ND_TTEST() rather than comparing against ndo->ndo_snapend ourselves;
it's easy to get the tests wrong.

Check for running out of packet data before checking for running out of
captured data, and distinguish between running out of packet data (which
might just mean "no more strings") and running out of captured data
(which means "truncated").

This fixes a buffer over-read discovered by Forcepoint's security
researchers Otto Airamo & Antti Levomäki.

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:
parse_field(netdissect_options *ndo, const char **pptr, int *len)
    if (*len <= 0 || !pptr || !*pptr)
	return NULL;
    if (*pptr > (const char *) ndo->ndo_snapend)
	return NULL;

    while (*pptr <= (const char *) ndo->ndo_snapend && *len >= 0 && **pptr) {
    if (*len < 0 || *pptr > (const char *) ndo->ndo_snapend)
	return NULL;
#define PARSE_STRING				\
	s = parse_field(ndo, &parse, &parselen);	\
    if (lose) {
	ND_PRINT((ndo, " [|zephyr] (%d)", length));
	return;
    }

Fixed code:
parse_field(netdissect_options *ndo, const char **pptr, int *len, int *truncated)
    /* Start of string */
    /* Scan for the NUL terminator */
    for (;;) {
	if (*len == 0) {
	    /* Ran out of packet data without finding it */
	    return NULL;
	}
	if (!ND_TTEST(**pptr)) {
	    /* Ran out of captured data without finding it */
	    *truncated = 1;
	    return NULL;
	}
	if (**pptr == '\0') {
	    /* Found it */
	    break;
	}
	/* Keep scanning */
    /* Skip the NUL terminator */
    int truncated = 0;
#define PARSE_STRING						\
	s = parse_field(ndo, &parse, &parselen, &truncated);	\
	if (truncated) goto trunc;				\
    if (lose)
        goto trunc;
    return;

trunc:
    ND_PRINT((ndo, " [|zephyr] (%d)", length));
    return;
zephyr-oobr		zephyr-oobr.pcap		zephyr-oobr.out		-vvv -e
00:16:ca:92:12:01 > 00:15:e8:97:b2:01, ethertype IPv4 (0x0800), length 65535: (tos 0x0, ttl 124, id 16059, offset 0, flags [none], proto UDP (17), length 65521)
    167.155.6.190.2104 > 167.155.9.153.514: [udp sum ok]
CVE-2017-12902 (Other, published 2017-09-14T06:29Z)
Description: value: The Zephyr parser in tcpdump before 4.9.2 has a buffer over-read in print-zephyr.c, several functions.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
tests/TESTLIST
tests/hoobr_parse_field.out
Commit message: CVE-2017-12902/Zephyr: Add an additional test.

File from Kamil Frankowicz.


Vulnerable code:

Fixed code:
hoobr_parse_field	hoobr_parse_field.pcap		hoobr_parse_field.out
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0010:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0020:  3030                                     00
IP 48.48.48.48.2104 > 48.48.48.48.12336:  [|zephyr] (12308)
CVE-2017-12985 (Other, published 2017-09-14T06:29Z)
Description: value: The IPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-ip6.c:ip6_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-ip6.c
print-mobility.c
tests/TESTLIST
tests/ipv6-next-header-oobr-1.out
tests/ipv6-next-header-oobr-2.out
Commit message: CVE-2017-12985/IPv6: Check for print routines returning -1 when running past the end.

rt6_print(), ah_print(), and esp_print() return -1 if they run up
against the end of the packet while dissecting; if that happens, stop
dissecting, don't try to fetch the next header value, because 1) *it*
might be past the end of the packet and 2) we won't be using it in any
case, as we'll be exiting the loop.

Also, change mobility_print() to return -1 if it runs up against the
end of the packet, and stop dissecting if it does so.

This fixes a buffer over-read discovered by Brian 'geeknik' Carpenter.

Add tests using the capture files supplied by the reporter(s).


Vulnerable code:
	return(mhlen);

Fixed code:
		if (len < (u_int)advance)
			goto trunc;
			if (advance < 0)
				return;
			ND_TCHECK(*cp);
			if (advance < 0)
				return;
			if (advance < 0)
				return;
			if (advance < 0)
				return;
	return(-1);
ipv6-next-header-oobr-1	ipv6-next-header-oobr-1.pcap	ipv6-next-header-oobr-1.out
ipv6-next-header-oobr-2	ipv6-next-header-oobr-2.pcap	ipv6-next-header-oobr-2.out
IP6 3030:3030:3030:3030:3030:3030:3030:3030 > 3030:3030:3030:3030:3030:3030:3030:3030: HBH [|ip6]
IP6 3030:3030:3030:3030:3030:3030:3030:3030 > 3030:3030:3030:3030:3030:3030:3030:3030: HBH [|AH]
CVE-2017-12986 (C, published 2017-09-14T06:29Z)
Description: value: The IPv6 routing header parser in tcpdump before 4.9.2 has a buffer over-read in print-rt6.c:rt6_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
ip6.h
tests/TESTLIST
tests/ipv6-rthdr-oobr.out
Commit message: CVE-2017-12986/IPv6 R.H.: Update to reflect the actual IPv6 RFC.

In RFC 1883, the Type 0 routing header had a 1-byte reserved field and a
3-byte strict/loose bit map; in RFC 2460, that changed to a 4-byte
reserved field.

This fixes a buffer over-read discovered by Brian 'geeknik' Carpenter (by
making an ND_TCHECK() call check for the presence in the captured data
of all 4 bytes of the reserved field; we were printing it as a 4-byte
field, so we needed to check for them).

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:
	uint8_t  ip6r0_segleft;	/* segments left */
	uint8_t  ip6r0_reserved;	/* reserved field */
	uint8_t  ip6r0_slmap[3];	/* strict/loose bit map */

Fixed code:
	uint8_t  ip6r0_segleft;		/* segments left */
	uint32_t ip6r0_reserved;	/* reserved field */
ipv6-rthdr-oobr		ipv6-rthdr-oobr.pcap		ipv6-rthdr-oobr.out
IP6 3030:3030:3030:3030:3030:3030:3030:3030 > 3030:3030:3030:3030:3030:3030:3030:3030: srcrt (len=48, type=0, segleft=48[|srcrt]
CVE-2017-12987 (Other, published 2017-09-14T06:29Z)
Description: value: The IEEE 802.11 parser in tcpdump before 4.9.2 has a buffer over-read in print-802_11.c:parse_elements().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-802_11.c
tests/TESTLIST
tests/ieee802.11_tim_ie_oobr.out
Commit message: CVE-2017-12987/IEEE 802.11: Fix processing of TIM IE.

The arguments to memcpy() were completely wrong.

This fixes a buffer over-read discovered by Kamil Frankowicz.

Add a test using the capture file supplied by Brian 'geeknik' Carpenter.


Vulnerable code:
			memcpy(tim.bitmap, p + (tim.length - 3),
			    (tim.length - 3));

Fixed code:
			memcpy(tim.bitmap, p + offset + 3, tim.length - 3);
ieee802.11_tim_ie_oobr	ieee802.11_tim_ie_oobr.pcap	ieee802.11_tim_ie_oobr.out
ReAssoc Response AID(3030) : PRIVACY : n/a[|802.11]
ReAssoc Response AID(3030) : PRIVACY : n/a[|802.11]
[|802.11]
ReAssoc Response AID(3030) : PRIVACY : n/a[|802.11]
CVE-2017-12987 (Other, published 2017-09-14T06:29Z)
Description: value: The IEEE 802.11 parser in tcpdump before 4.9.2 has a buffer over-read in print-802_11.c:parse_elements().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
tests/TESTLIST
tests/oobr_parse_elements.out
Commit message: CVE-2017-12987/Another test for the TIM IE bug, from Kamil Frankowicz.


Vulnerable code:

Fixed code:
oobr_parse_elements	oobr_parse_elements.pcap	oobr_parse_elements.out
Beacon IBSS, PRIVACY[|802.11]
CVE-2017-12993 (Other, published 2017-09-14T06:29Z)
Description: value: The Juniper protocols parser in tcpdump before 4.9.2 has a buffer over-read in print-juniper.c, several functions.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-juniper.c
tests/TESTLIST
tests/hoobr_juniper.out
tests/hoobr_juniper2.out
tests/hoobr_juniper3.out
Commit message: CVE-2017-12993/Juniper: Add more bounds checks.

This fixes a buffer over-read discovered by Kamil Frankowicz.

Add tests using the capture files supplied by the reporter(s).


Vulnerable code:

Fixed code:
        ND_TCHECK(*gh);

trunc:
	ND_PRINT((ndo, "[|juniper_services]"));
	return l2info.header_len;
        ND_TCHECK(*ih);

trunc:
	ND_PRINT((ndo, "[|juniper_services]"));
	return l2info.header_len;
        ND_TCHECK(*mh);

trunc:
	ND_PRINT((ndo, "[|juniper_services]"));
	return l2info.header_len;
        ND_TCHECK(*sh);

trunc:
	ND_PRINT((ndo, "[|juniper_services]"));
	return l2info.header_len;
        ND_TCHECK2(p[0], 2);

trunc:
	ND_PRINT((ndo, "[|juniper_pppoe_atm]"));
	return l2info.header_len;
        ND_TCHECK2(p[0], 3);

trunc:
	ND_PRINT((ndo, "[|juniper_atm1]"));
	return l2info.header_len;
        ND_TCHECK2(p[0], 3);

trunc:
	ND_PRINT((ndo, "[|juniper_atm2]"));
	return l2info.header_len;
    ND_TCHECK(p[0]);
            ND_TCHECK2(p[0], 2);
            ND_TCHECK2(p[0], 2);
hoobr_juniper		hoobr_juniper.pcap		hoobr_juniper.out
hoobr_juniper2		hoobr_juniper2.pcap		hoobr_juniper2.out
hoobr_juniper3		hoobr_juniper3.pcap		hoobr_juniper3.out
[|juniper_hdr], length 808464432
[|juniper_atm1]
Unknown Juniper DLT_ type 132: [|juniper_services]
CVE-2017-13000 (Other, published 2017-09-14T06:29Z)
Description: value: The IEEE 802.15.4 parser in tcpdump before 4.9.2 has a buffer over-read in print-802_15_4.c:ieee802_15_4_if_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-802_15_4.c
tests/802_15_4-data.out
tests/TESTLIST
Commit message: CVE-2017-13000/IEEE 802.15.4: Fix bug introduced by previous fix.

We've already advanced the pointer past the PAN ID, if present; it now
points to the address, so don't add 2 to it.

This fixes a buffer over-read discovered by Forcepoint's security
researchers Otto Airamo & Antti Levomäki.

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:
			ND_PRINT((ndo,"%04x:%s ", panid, le64addr_string(ndo, p + 2)));

Fixed code:
			ND_PRINT((ndo,"%04x:%s ", panid, le64addr_string(ndo, p)));
IEEE 802.15.4 Data packet seq 01 ab4d:10:05:00:81:00:01:00:01 < [|802.15.4]
802_15_4-data		802_15_4-data.pcap		802_15_4-data.out	-vvv -e
CVE-2017-13000 (Other, published 2017-09-14T06:29Z)
Description: value: The IEEE 802.15.4 parser in tcpdump before 4.9.2 has a buffer over-read in print-802_15_4.c:ieee802_15_4_if_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-802_15_4.c
tests/802_15_4_beacon.out
tests/TESTLIST
Commit message: CVE-2017-13000/IEEE 802.15.4: Fix bug introduced two fixes prior.

We've already advanced the pointer past the PAN ID, if present; it now
points to the address, so don't add 2 to it.

This fixes a buffer over-read discovered by Forcepoint's security
researchers Otto Airamo & Antti Levomäki.

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:
			ND_PRINT((ndo,"%04x:%04x ", panid, EXTRACT_LE_16BITS(p + 2)));

Fixed code:
			ND_PRINT((ndo,"%04x:%04x ", panid, EXTRACT_LE_16BITS(p)));
IEEE 802.15.4 Beacon packet seq cd ffab:cdff < [|802.15.4]
802_15_4_beacon		802_15_4_beacon.pcap		802_15_4_beacon.out	-vvv -e
CVE-2017-13002 (Other, published 2017-09-14T06:29Z)
Description: value: The AODV parser in tcpdump before 4.9.2 has a buffer over-read in print-aodv.c:aodv_extension().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-aodv.c
tests/TESTLIST
tests/hoobr_aodv_extension.out
Commit message: CVE-2017-13002/AODV: Add some missing bounds checks.

In aodv_extension() do a bounds check on the extension header before we
look at it.

This fixes a buffer over-read discovered by Kamil Frankowicz.

Add a test using the capture file supplied by the reporter(s).

While we're at it, add the RFC number, and check the validity of the
length for the Hello extension.


Vulnerable code:

Fixed code:
/*
 * RFC 3561
 */
	ND_TCHECK(*ep);
		if (ep->length < 4) {
			ND_PRINT((ndo, "\n\text HELLO - bad length %u", ep->length));
			break;
		}
hoobr_aodv_extension	hoobr_aodv_extension.pcap	hoobr_aodv_extension.out
IP 48.48.48.48.654 > 48.48.48.48.12336:  aodv rrep 12308  prefix 16 hops 48
	dst 48.48.48.48 dseq 808464432 src 48.48.48.48 808464432 ms [|hello]
CVE-2017-13004 (Other, published 2017-09-14T06:29Z)
Description: value: The Juniper protocols parser in tcpdump before 4.9.2 has a buffer over-read in print-juniper.c:juniper_parse_header().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-juniper.c
tests/TESTLIST
tests/juniper_atm1.out
tests/juniper_es.out
Commit message: CVE-2017-13004/Juniper: Add a bounds check.

This fixes a buffer over-read discovered by Forcepoint's security
researchers Otto Airamo & Antti Levomäki.

Add tests using the capture files supplied by the reporter(s).


Vulnerable code:

Fixed code:
            ND_TCHECK_16BITS(p+l2info->cookie_len);
juniper_atm1		juniper_atm1.pcap		juniper_atm1.out	-vvv -e
juniper_es		juniper_es.pcap			juniper_es.out	-vvv -e
Out 
	Juniper PCAP Flags [none]ATM1-PIC, cookie-len 4, cookie 0x30303030: [|juniper_hdr], length 808464432
Out 
	Juniper PCAP Flags [none]ES-PIC, cookie-len 0: [|juniper_hdr], length 808464432
CVE-2017-13004 (Other, published 2017-09-14T06:29Z)
Description: value: The Juniper protocols parser in tcpdump before 4.9.2 has a buffer over-read in print-juniper.c:juniper_parse_header().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
tests/TESTLIST
tests/hoobr_juniper4.out
Commit message: CVE-2017-13004/Juniper: Add a capture file.

File from Kamil Frankowicz testing an existing fix.

(Same problem, and same fix, as the recent Juniper fixes.)


Vulnerable code:

Fixed code:
hoobr_juniper4		hoobr_juniper4.pcap		hoobr_juniper4.out
[|juniper_hdr], length 808464432
CVE-2017-13007 (Other, published 2017-09-14T06:29Z)
Description: value: The Apple PKTAP parser in tcpdump before 4.9.2 has a buffer over-read in print-pktap.c:pktap_if_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-pktap.c
tests/TESTLIST
tests/pktap-heap-overflow.out
Commit message: CVE-2017-13007/PKTAP: Pass a properly updated struct pcap_pkthdr to the sub-dissector.

The sub-dissector expects that the length and captured length will
reflect the actual remaining data in the packet, not the raw amount
including the PKTAP header; pass an updated header, just as we do for
PPI.

This fixes a buffer over-read discovered by Yannick Formaggio.

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:
			hdrlen += printer(ndo, h, p);

Fixed code:
	struct pcap_pkthdr nhdr;
			nhdr = *h;
			nhdr.caplen = caplen;
			nhdr.len = length;
			hdrlen += printer(ndo, &nhdr, p);
pktap-heap-overflow	pktap-heap-overflow.pcap	pktap-heap-overflow.out	-v
[|pktap]
[|ppp]
EXIT CODE 00000100
CVE-2017-13008 (Other, published 2017-09-14T06:29Z)
Description: value: The IEEE 802.11 parser in tcpdump before 4.9.2 has a buffer over-read in print-802_11.c:parse_elements().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-802_11.c
tests/TESTLIST
tests/ieee802.11_rates_oobr.out
Commit message: CVE-2017-13008/IEEE 802.11: Fix TIM bitmap copy to copy from p + offset.

offset has already been advanced to point to the bitmap; we shouldn't
add the amount to advance again.

This fixes a buffer over-read discovered by Brian 'geeknik' Carpenter.

Add a test using the capture file supplied by the reporter(s).

While we're at it, remove some redundant tests - we've already checked,
before the case statement, whether we have captured the entire
information element and whether the entire information element is
present in the on-the-wire packet; in the cases for particular IEs, we
only need to make sure we don't go past the end of the IE.


Vulnerable code:
				if (!ND_TTEST2(*(p + offset), ssid.length))
					return 0;
				if (length < ssid.length)
					return 0;
				if (!ND_TTEST2(*(p + offset), challenge.length))
					return 0;
				if (length < challenge.length)
					return 0;
				if (!ND_TTEST2(*(p + offset), rates.length))
					return 0;
				if (length < rates.length)
					return 0;
			memcpy(tim.bitmap, p + offset + 3, tim.length - 3);

Fixed code:
			memcpy(tim.bitmap, p + offset, tim.length - 3);
ieee802.11_rates_oobr	ieee802.11_rates_oobr.pcap	ieee802.11_rates_oobr.out
fhset 48 fhpat 48 48dBm signal 48dB signal 48dB noise [|802.11]Beacon IBSS, PRIVACY[|802.11]