hitoshura25/cvefixes huggingface dataset:
CVE-2017-13009 (Other, published 2017-09-14T06:29Z)
Description: value: The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-mobility.c
tests/TESTLIST
tests/ipv6-mobility-header-oobr.out
Commit message: CVE-2017-13009/IPv6 mobility: Add a bounds check.

This fixes a buffer over-read discovered by Brian 'geeknik' Carpenter.

Add a test using the capture file supplied by the reporter(s).

While we're at it:

Add a comment giving the RFC for IPv6 mobility headers.

Clean up some bounds checks to make it clearer what they're checking, by
matching the subsequent EXTRACT_ calls or memcpy.

For the binding update, if none of the flag bits are set, don't check
the individual flag bits.


Vulnerable code:
			ND_TCHECK2(*mh, hlen + 8);
			ND_TCHECK2(*mh, hlen + 8);
			ND_TCHECK2(*mh, hlen + 8);
		ND_TCHECK2(*mh, hlen + 1);
		if (bp[hlen] & 0xf0)
		if (bp[hlen] & 0x80)
			ND_PRINT((ndo, "A"));
		if (bp[hlen] & 0x40)
			ND_PRINT((ndo, "H"));
		if (bp[hlen] & 0x20)
			ND_PRINT((ndo, "L"));
		if (bp[hlen] & 0x10)
			ND_PRINT((ndo, "K"));
		ND_TCHECK2(*mh, hlen + 2);
		ND_TCHECK2(*mh, hlen + 2);
		ND_TCHECK2(*mh, hlen + 2);
		ND_TCHECK2(*mh, hlen + 16);

Fixed code:
/* RFC 3775 */
			ND_TCHECK_32BITS(&bp[hlen + 4]);
			ND_TCHECK_32BITS(&bp[hlen + 4]);
			ND_TCHECK_32BITS(&bp[hlen + 4]);
		ND_TCHECK_16BITS(&bp[hlen]);
		if (bp[hlen] & 0xf0) {
			if (bp[hlen] & 0x80)
				ND_PRINT((ndo, "A"));
			if (bp[hlen] & 0x40)
				ND_PRINT((ndo, "H"));
			if (bp[hlen] & 0x20)
				ND_PRINT((ndo, "L"));
			if (bp[hlen] & 0x10)
				ND_PRINT((ndo, "K"));
		}
		ND_TCHECK_16BITS(&bp[hlen]);
		ND_TCHECK(mh->ip6m_data8[1]);
		ND_TCHECK_16BITS(&bp[hlen]);
		ND_TCHECK_16BITS(&bp[hlen]);
		ND_TCHECK2(bp[hlen], 16);
ipv6-mobility-header-oobr	ipv6-mobility-header-oobr.pcap	ipv6-mobility-header-oobr.out
IP6 3030:3030:3030:3030:3030:3030:3030:3030 > 3030:3030:3030:3030:3030:3030:3030:3030: mobility: BA status=48[|MOBILITY]
CVE-2017-13010 (Other, published 2017-09-14T06:29Z)
Description: value: The BEEP parser in tcpdump before 4.9.2 has a buffer over-read in print-beep.c:l_strnstart().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-beep.c
tests/TESTLIST
tests/beep-oobr.out
Commit message: CVE-2017-13010/BEEP: Do bounds checking when comparing strings.

This fixes a buffer over-read discovered by Brian 'geeknik' Carpenter.

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:
l_strnstart(const char *tstr1, u_int tl1, const char *str2, u_int l2)

	if (l_strnstart("MSG", 4, (const char *)bp, length)) /* A REQuest */
	else if (l_strnstart("RPY ", 4, (const char *)bp, length))
	else if (l_strnstart("ERR ", 4, (const char *)bp, length))
	else if (l_strnstart("ANS ", 4, (const char *)bp, length))
	else if (l_strnstart("NUL ", 4, (const char *)bp, length))
	else if (l_strnstart("SEQ ", 4, (const char *)bp, length))
	else if (l_strnstart("END", 4, (const char *)bp, length))

Fixed code:
l_strnstart(netdissect_options *ndo, const char *tstr1, u_int tl1,
    const char *str2, u_int l2)
	if (!ND_TTEST2(*str2, tl1)) {
		/*
		 * We don't have tl1 bytes worth of captured data
		 * for the string, so we can't check for this
		 * string.
		 */
		return 0;
	}
	if (l_strnstart(ndo, "MSG", 4, (const char *)bp, length)) /* A REQuest */
	else if (l_strnstart(ndo, "RPY ", 4, (const char *)bp, length))
	else if (l_strnstart(ndo, "ERR ", 4, (const char *)bp, length))
	else if (l_strnstart(ndo, "ANS ", 4, (const char *)bp, length))
	else if (l_strnstart(ndo, "NUL ", 4, (const char *)bp, length))
	else if (l_strnstart(ndo, "SEQ ", 4, (const char *)bp, length))
	else if (l_strnstart(ndo, "END", 4, (const char *)bp, length))
beep-oobr		beep-oobr.pcap			beep-oobr.out
unknown ip 3
IP6 3030:3030:3030:3030:3030:3030:3030:3030.10288 > 3030:3030:3030:3030:3030:3030:3030:3030.12336: Flags [.U], seq 808464432:808476740, ack 808464432, win 12336, urg 12336, options [eol], length 12308 BEEP (payload or undecoded)
CVE-2017-13012 (Other, published 2017-09-14T06:29Z)
Description: value: The ICMP parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp.c:icmp_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-icmp.c
tests/TESTLIST
tests/extract_read2_asan.out
Commit message: CVE-2017-13012/ICMP: Add a missing bounds check.

Check before fetching the length from the included packet's IPv4 header.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.


Vulnerable code:

Fixed code:
		ND_TCHECK_16BITS(&ip->ip_len);
extract_read2_asan	extract_read2_asan.pcap		extract_read2_asan.out	-v
IP (tos 0x14, id 1, offset 0, flags [none], proto ICMP (1), length 512, options (unknown 3,unknown 3,unknown 3 [bad length 3]), bad cksum 3ff (->b4bd)!)
    240.25.0.0 > 3.3.3.3: ICMP source quench, length 484
	[|icmp]
CVE-2017-13014 (Other, published 2017-09-14T06:29Z)
Description: value: The White Board protocol parser in tcpdump before 4.9.2 has a buffer over-read in print-wb.c:wb_prep(), several functions.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-wb.c
tests/TESTLIST
tests/wb-oobr.out
Commit message: CVE-2017-13014/White Board: Do more bounds checks.

This fixes a buffer over-read discovered by Yannick Formaggio.

Add a test using the capture file supplied by the reporter(s).

While we're at it, print a truncation error if the packets are
truncated, rather than just, in effect, ignoring the result of the
routines that print particular packet types.


Vulnerable code:
	if (len < sizeof(*prep)) {
	}

Fixed code:
	if (len < sizeof(*prep) || !ND_TTEST(*prep))
		ND_PRINT((ndo, "%s", tstr));
		ND_PRINT((ndo, "%s", tstr));
		ND_PRINT((ndo, "%s", tstr));
		ND_PRINT((ndo, "%s", tstr));
		ND_PRINT((ndo, "%s", tstr));
		ND_PRINT((ndo, "%s", tstr));
wb-oobr			wb-oobr.pcap			wb-oobr.out	-v
MPLS (label 197376, exp 7, [S], ttl 48)
	IP (tos 0x30, ttl 48, id 12336, offset 0, flags [none], proto UDP (17), length 12336, bad cksum 3030 (->7754)!)
    48.4.4.4.4400 > 127.0.0.1.3503: 
		 packet exceeded snapshot
IP (tos 0x30, ttl 48, id 12336, offset 0, flags [none], proto UDP (17), length 12336, bad cksum 3030 (->699d)!)
    48.48.48.48.3503 > 48.48.48.48.4567: * wb-prep:[|wb]
MPLS (label 197376, exp 7, [S], ttl 48)
	IP (tos 0x30, ttl 48, id 12336, offset 0, flags [none], proto UDP (17), length 12336, bad cksum 3030 (->699d)!)
    48.48.48.48.4400 > 48.48.48.48.3503: 
		 packet exceeded snapshot
IP (tos 0x30, ttl 48, id 12336, offset 0, flags [none], proto UDP (17), length 12336, bad cksum 3030 (->c624)!)
    48.48.0.1.3503 > 48.4.4.4.4567: * wb-prep:[|wb]
MPLS (label 197376, exp 7, [S], ttl 48)
	IP (tos 0x30, ttl 48, id 12336, offset 0, flags [none], proto UDP (17), length 12336, bad cksum 3030 (->7754)!)
    48.4.4.4.4400 > 127.0.0.1.3503: 
		 packet exceeded snapshot
IP (tos 0x30, ttl 48, id 12336, offset 0, flags [none], proto UDP (17), length 12336, bad cksum 3030 (->c624)!)
    48.48.0.1.3503 > 48.4.4.4.4567: * wb-prep:[|wb]
CVE-2017-13015 (Other, published 2017-09-14T06:29Z)
Description: value: The EAP parser in tcpdump before 4.9.2 has a buffer over-read in print-eap.c:eap_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-eap.c
tests/TESTLIST
tests/eap_extract_read2_asan.out
Commit message: CVE-2017-13015/EAP: Add more bounds checks.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.


Vulnerable code:
                   tok2str(eap_type_values, "unknown", *(tptr+4)),
                   *(tptr + 4)));
                ND_PRINT((ndo, " TTLSv%u",
                       EAP_TTLS_VERSION(*(tptr + 5)))); /* fall through */

Fixed code:
        ND_TCHECK_8BITS(tptr);
        ND_TCHECK_16BITS(tptr+2);
            ND_TCHECK_8BITS(tptr+4);
                   tok2str(eap_type_values, "unknown", subtype),
                   subtype));
                    ND_TCHECK_8BITS(tptr+count);
                ND_TCHECK_8BITS(tptr + 5);
                if (subtype == EAP_TYPE_TTLS)
                    ND_PRINT((ndo, " TTLSv%u",
                           EAP_TTLS_VERSION(*(tptr + 5))));
                    ND_TCHECK_32BITS(tptr + 6);
                ND_TCHECK_8BITS(tptr + 5);
                    ND_TCHECK_32BITS(tptr + 6);
                ND_TCHECK_8BITS(tptr + 5);
eap_extract_read2_asan	eap_extract_read2_asan.pcap	eap_extract_read2_asan.out	-v
EAP packet (0) v155, len 0
	[|EAP]
CVE-2017-13017 (Other, published 2017-09-14T06:29Z)
Description: value: The DHCPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-dhcp6.c:dhcp6opt_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-dhcp6.c
tests/TESTLIST
tests/dhcp6_reconf_asan.out
Commit message: CVE-2017-13017/DHCPv6: Add a missing option length check.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.


Vulnerable code:

Fixed code:
			if (optlen != 1) {
				ND_PRINT((ndo, " ?)"));
				break;
			}
dhcp6_reconf_asan	dhcp6_reconf_asan.pcap		dhcp6_reconf_asan.out	-v
IP (tos 0x60, ttl 254, id 21519, offset 0, flags [+, DF, rsvd], proto UDP (17), length 768, options (EOL), bad cksum 9615 (->c6f)!)
    251.73.86.150.514 > 126.172.217.192.546: dhcp6 relay-reply (linkaddr=300:10ed:ff:f01:f:0:7f:7f peeraddr=ffb6:3a64::c1:2300:581c:d00 (reconfigure-message ?) (reconfigure-message ?))
CVE-2017-13018 (Other, published 2017-09-14T06:29Z)
Description: value: The PGM parser in tcpdump before 4.9.2 has a buffer over-read in print-pgm.c:pgm_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-pgm.c
tests/TESTLIST
tests/pgm_opts_asan.out
Commit message: CVE-2017-13018/PGM: Add a missing bounds check.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.


Vulnerable code:

Fixed code:
		if (!ND_TTEST2(*bp, 2)) {
		    ND_PRINT((ndo, " [|OPT]"));
		    return;
		}
pgm_opts_asan		pgm_opts_asan.pcap		pgm_opts_asan.out	-v
IP (tos 0x41,ECT(1), id 0, offset 0, flags [none], proto PGM (113), length 32639, options (unknown 89 [bad length 232]), bad cksum 5959 (->9eb9)!)
    128.121.89.107 > 89.89.16.63: 128.121.89.107.4 > 89.89.16.63.225: PGM, length 0 0x3414eb1f0022 UNKNOWN type 0x1f OPTS LEN 225 OPT_1F [13]  OPT_06 [26]  PATH_NLA [4] [|OPT]
CVE-2017-13020 (Other, published 2017-09-14T06:29Z)
Description: value: The VTP parser in tcpdump before 4.9.2 has a buffer over-read in print-vtp.c:vtp_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
tests/TESTLIST
tests/vtp_asan-2.out
Commit message: CVE-2017-13020/VTP: Add another test.

A capture file supplied by Bhargava Shastry, modified so the capture
file won't be rejected as an invalid capture.


Vulnerable code:

Fixed code:
vtp_asan-2		vtp_asan-2.pcap			vtp_asan-2.out	-v
FRF.16 Frag, seq 193, Flags [Begin, End], UI 08! VTPv69, Message Subset advertisement (0x02), length 2126400013
	Domain name: , Seq number: 0, Config Rev fb499603
	VLAN info status Unknown, type TrCRF, VLAN-id 256, MTU 771, SAID 0x03030303, Name ^C^I^C[|vtp]
CVE-2017-13020 (Other, published 2017-09-14T06:29Z)
Description: value: The VTP parser in tcpdump before 4.9.2 has a buffer over-read in print-vtp.c:vtp_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-vtp.c
tests/TESTLIST
tests/vtp_asan.out
Commit message: CVE-2017-13020/VTP: Add some missing bounds checks.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.


Vulnerable code:

Fixed code:
	ND_TCHECK_32BITS(tptr);
	    ND_TCHECK_8BITS(tptr);
vtp_asan		vtp_asan.pcap			vtp_asan.out	-v
FRF.16 Frag, seq 193, Flags [Begin, End], UI 08! VTPv69, Message Subset advertisement (0x02), length 2126400013
	Domain name: , Seq number: 0[|vtp]
[|mfr]
[|mfr]
[|mfr]
[|mfr]
CVE-2017-13021 (Other, published 2017-09-14T06:29Z)
Description: value: The ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-icmp6.c
tests/TESTLIST
tests/icmp6_mobileprefix_asan.out
Commit message: CVE-2017-13021/ICMP6: Add a missing bounds check.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.


Vulnerable code:

Fixed code:
			ND_TCHECK(dp->icmp6_data16[1]);
icmp6_mobileprefix_asan	icmp6_mobileprefix_asan.pcap	icmp6_mobileprefix_asan.out	-v
IP6 (class 0x50, flowlabel 0x0002c, hlim 0, next-header ICMPv6 (58) payload length: 7168) 4f:f829:c:1a1a:1a1a:1a1a:1a37:0 > 16:0:400:0:64fb:9303:f293:8200: ICMP6, mobile router advertisement, length 7168, id 0x9393[|icmp6]
[|ether]
CVE-2017-13022 (Other, published 2017-09-14T06:29Z)
Description: value: The IP parser in tcpdump before 4.9.2 has a buffer over-read in print-ip.c:ip_printroute().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-ip.c
tests/TESTLIST
tests/ip_printroute_asan.out
Commit message: CVE-2017-13022/IP: Add bounds checks to ip_printroute().

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.


Vulnerable code:
static void
		return;
			ip_printroute(ndo, cp, option_len);

Fixed code:
static int
		return (0);
	ND_TCHECK(cp[2]);
		ND_TCHECK2(cp[len], 4);
	return (0);

trunc:
	return (-1);
			if (ip_printroute(ndo, cp, option_len) == -1)
				goto trunc;
ip_printroute_asan	ip_printroute_asan.pcap		ip_printroute_asan.out	-v
IP (tos 0x0, ttl 254, id 25615, offset 65480, flags [DF, rsvd], proto UDP (17), length 32768, options (LSRR [bad length 25] [bad ptr 15] 103.103.103.0, 0.172.0.116, 0.16.36.36, 16.0.36.2 14.9.36.4[|ip]))
    251.73.86.0 > 0.172.128.5: ip-proto-17
CVE-2017-13023 (Other, published 2017-09-14T06:29Z)
Description: value: The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_opt_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-mobility.c
tests/TESTLIST
tests/mobility_opt_asan.out
Commit message: CVE-2017-13023/IPv6 mobility: Add a bounds check before fetching data

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't cause 'tcpdump: pcap_loop: truncated dump file'


Vulnerable code:

Fixed code:
			ND_TCHECK_16BITS(&bp[i+2]);
mobility_opt_asan	mobility_opt_asan.pcap		mobility_opt_asan.out	-v
IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62) payload length: 7168) d400:7fa1:0:400::6238:2949 > 9675:86dd:7300:2c:1c7f:ffff:ffc3:b2a1: mobility: BU seq#=116 A lifetime=15872(pad1)[|MOBILITY]
IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62) payload length: 7168) d4c3:b2a1:200:400::6238:2949 > 9675:86dd:73f0:2c:1c7f:ffff:ebc3:b291: mobility: BU seq#=116 A lifetime=15360[|MOBILITY]
CVE-2017-13024 (Other, published 2017-09-14T06:29Z)
Description: value: The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_opt_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-mobility.c
tests/TESTLIST
tests/mobility_opt_asan_2.out
Commit message: CVE-2017-13024/IPv6 mobility: Add a bounds check before fetching data

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't cause 'tcpdump: pcap_loop: truncated dump file'


Vulnerable code:

Fixed code:
			ND_TCHECK_16BITS(&bp[i+2]);
			ND_TCHECK_16BITS(&bp[i+4]);
mobility_opt_asan_2	mobility_opt_asan_2.pcap	mobility_opt_asan_2.out	-v
IP6 (class 0x50, flowlabel 0x0002c, hlim 0, next-header Mobile IP (old) (62) payload length: 7168) ff:7f0f:40:0:ee00:0:b658:5203 > 205:20:1:b00:0:2200:af01:e000: mobility: BRR(type-0x06: len=0)[|MOBILITY]
CVE-2017-13024 (Other, published 2017-09-14T06:29Z)
Description: value: The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_opt_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
tests/TESTLIST
tests/mobility_opt_asan_4.out
Commit message: CVE-2017-13024/IPv6 mobility: Add another test for a previous bounds check fix

This is another capture file supplied by Bhargava Shastry, modified
so the capture file won't cause 'tcpdump: pcap_loop: truncated dump file'


Vulnerable code:

Fixed code:
mobility_opt_asan_4	mobility_opt_asan_4.pcap	mobility_opt_asan_4.out	-v
IP6 (class 0x50, flowlabel 0x00004, hlim 237, next-header Mobile IP (old) (62) payload length: 7168) d3c3:b2a9:200:400::6238:2949 > 9675:86dd:7300:2c:1c7f:ffff:ffc3:b2a1: mobility: BU seq#=116 A lifetime=15360(pad1)(pad1)(type-0x3c: len=19)(ni: ho=0x0400 co=0x0012)[|MOBILITY]
CVE-2017-13025 (C, published 2017-09-14T06:29Z)
Description: value: The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_opt_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
extract.h
print-mobility.c
tests/TESTLIST
tests/mobility_opt_asan_3.out
Commit message: CVE-2017-13025/IPv6 mobility: Add a bounds check before fetching data

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't cause 'tcpdump: pcap_loop: truncated dump file'


Vulnerable code:

Fixed code:

#define ND_TTEST_128BITS(p) ND_TTEST2(*(p), 16)
#define ND_TCHECK_128BITS(p) ND_TCHECK2(*(p), 16)
			ND_TCHECK_128BITS(&bp[i+2]);
mobility_opt_asan_3	mobility_opt_asan_3.pcap	mobility_opt_asan_3.out	-v
IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62) payload length: 7168) d400:7fa1:200:400::6238:2949 > 9675:86dd:7300:2c:1c7f:ffff:ffc3:b2a1: mobility: CoT nonce id=0x74 Care-of Init Cookie=80570f80:00000004[|MOBILITY]
IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62) payload length: 7168) ffc3:b2a1:200:400::6238:2949 > 9675:86dd:73f0:2c:1c7f:ffff:ebc3:b2a1: mobility: BU seq#=39837 lifetime=261452[|MOBILITY]
CVE-2017-13027 (Other, published 2017-09-14T06:29Z)
Description: value: The LLDP parser in tcpdump before 4.9.2 has a buffer over-read in print-lldp.c:lldp_mgmt_addr_tlv_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-lldp.c
tests/TESTLIST
tests/lldp_mgmt_addr_tlv_asan.out
Commit message: CVE-2017-13027/LLDP: Fix a bounds check.

The total length of the OID is the OID length plus the length of the OID
length itself.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.


Vulnerable code:
        if (tlen < oid_len) {

Fixed code:
        if (tlen < 1U + oid_len) {
lldp_mgmt_addr_tlv_asan	lldp_mgmt_addr_tlv_asan.pcap	lldp_mgmt_addr_tlv_asan.out	-v
LLDP, length 1048572
	Management Address TLV (8), length 15
	  Management Address length 6, AFI Reserved (0), no AF printer !
	  Unknown Interface Numbering (10): 666137427
	[|LLDP]
00:00:00:a0:d4:c3 > 06:04:e8:03:00:02, ethertype Unknown (0xb2a1), length 58785857: 
	0x0000:  0200 efff e5ff 804f 006e 0026 0000 0000  .......O.n.&....
	0x0010:  01                                       .
CVE-2017-13028 (Other, published 2017-09-14T06:29Z)
Description: value: The BOOTP parser in tcpdump before 4.9.2 has a buffer over-read in print-bootp.c:bootp_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
tests/TESTLIST
tests/bootp_asan-2.out
Commit message: CVE-2017-13028/BOOTP: Add another test.

A capture file supplied by Bhargava Shastry, modified so the capture
file won't be rejected as an invalid capture.


Vulnerable code:

Fixed code:
bootp_asan-2		bootp_asan-2.pcap		bootp_asan-2.out	-v
IP (tos 0x0, ttl 252, id 40207, offset 0, flags [+, DF, rsvd], proto UDP (17), length 60951, bad cksum ff (->8336)!)
    18.0.0.15.16896 > 107.95.83.32.68: BOOTP/DHCP, unknown (0x00), length 59384, htype 0, hlen 0, hops 13, xid 0x14000000, secs 3328 [|bootp]