CVE-2017-13016 (Other, published 2017-09-14T06:29Z)
Description: value: The ISO ES-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:esis_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
addrtoname.h
print-isoclns.c
tests/TESTLIST
tests/esis_snpa_asan-2.out
tests/esis_snpa_asan-3.out
tests/esis_snpa_asan-4.out
tests/esis_snpa_asan-5.out
tests/esis_snpa_asan.out
Commit message: CVE-2017-13016/ES-IS: Fix printing of addresses in RD PDUs.

Always print the SNPA, and flag it as such; only print it as a MAC
address if it's 6 bytes long.

Identify the NET as such.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add tests using the capture files supplied by the reporter(s), modified
so the capture files won't be rejected as an invalid capture.


Vulnerable code:
    LINKADDR_ATM
		if (netal == 0)
			ND_PRINT((ndo, "\n\t  %s", etheraddr_string(ndo, snpa)));
			ND_PRINT((ndo, "\n\t  %s", isonsap_string(ndo, neta, netal)));

Fixed code:
    LINKADDR_ATM,
    LINKADDR_OTHER
		if (snpal == 6)
			ND_PRINT((ndo, "\n\t  SNPA (length: %u): %s",
			       snpal,
			       etheraddr_string(ndo, snpa)));
			ND_PRINT((ndo, "\n\t  SNPA (length: %u): %s",
			       snpal,
			       linkaddr_string(ndo, snpa, LINKADDR_OTHER, snpal)));
		if (netal != 0)
			ND_PRINT((ndo, "\n\t  NET (length: %u) %s",
			       netal,
			       isonsap_string(ndo, neta, netal)));
esis_snpa_asan		esis_snpa_asan.pcap		esis_snpa_asan.out	-v
esis_snpa_asan-2	esis_snpa_asan-2.pcap		esis_snpa_asan-2.out	-v
esis_snpa_asan-3	esis_snpa_asan-3.pcap		esis_snpa_asan-3.out	-v
esis_snpa_asan-4	esis_snpa_asan-4.pcap		esis_snpa_asan-4.out	-v
esis_snpa_asan-5	esis_snpa_asan-5.pcap		esis_snpa_asan-5.out	-v
UI 22! ES-IS, length 65565
	redirect (6), v: 1, checksum: 0x70a1 (incorrect should be 0xf519), holding time: 22339s, length indicator: 17
	  00.22
	  SNPA (length: 0): <empty>, opt (0) too long
UI 22! ES-IS, length 65565
	unknown type: 0 (0), v: 1, checksum: 0x00a1 (incorrect should be 0x859d), holding time: 0s, length indicator: 17
	  0x0000:  0200 04ec ff00 0000
UI 22! ES-IS, length 2650865693
	redirect (6), v: 1, checksum: 0x0300 (incorrect should be 0xbce5), holding time: 21480s, length indicator: 17
	  ec.ff00.00
	  SNPA (length: 0): <empty>
UI 22! ES-IS, length 65565
	ESH (2), v: 1, checksum: 0x70a1 (incorrect should be 0xfb4e), holding time: 21315s, length indicator: 17
	  Number of Source Addresses: 2
	  NET (length: 0): isonsap_string: illegal length
	  NET (length: 4): ec.ff00.00, bad opts/li
UI 22! ES-IS, length 65565
	redirect (6), v: 1, checksum: 0x7034 (incorrect should be 0x44ec), holding time: 21315s, length indicator: 16
	  02.0400
	  SNPA (length: 0): <empty>
	  Unknown Option #0, length 0, value: 
UI 32! ES-IS, length 65565
	ESH (2), v: 1, checksum: 0x70a1 (incorrect should be 0xfb4e), holding time: 21315s, length indicator: 17
	  Number of Source Addresses: 2
	  NET (length: 0): isonsap_string: illegal length
	  NET (length: 4): ec.ff00.00, bad opts/li
UI 22! ES-IS, length 4244701213
	redirect (6), v: 1, checksum: 0x7034 (incorrect should be 0x36fe), holding time: 21315s, length indicator: 17
	  isonsap_string: illegal length
	  SNPA (length: 0): <empty>
	  NET (length: 4) 00.0000.00
Q.922, invalid address
UI 22! ES-IS, length 65565
	ESH (2), v: 1, checksum: 0x70a1 (incorrect should be 0xfc4c), holding time: 21315s, length indicator: 17
	  Number of Source Addresses: 3
	  NET (length: 0): isonsap_string: illegal length
	  NET (length: 4): ec.ff00.00
	  NET (length: 0): isonsap_string: illegal length
UI 22! ES-IS, length 65565
	redirect (6), v: 1, checksum: 0x7034 (incorrect should be 0x3ff0), holding time: 21315s, length indicator: 17
	  04
	  SNPA (length: 4): 00:00:00:00, bad opts/li
UI 22! ES-IS, length 65565
	ESH (2), v: 1, checksum: 0x70a1 (incorrect should be 0xfb4e), holding time: 21315s, length indicator: 17
	  Number of Source Addresses: 2
	  NET (length: 0): isonsap_string: illegal length
	  NET (length: 4): ec.ff00.00, bad opts/li
UI 22! ES-IS, length 65565
	redirect (6), v: 1, checksum: 0xffff (incorrect should be 0x6b16), holding time: 21253s, length indicator: 17
	  00.04ec.0000
	  SNPA (length: 0): <empty>, bad opts/li
Q.922, hdr-len 2, DLCI 0, Flags [FECN], NLPID unknown (0x22), length 72482: 
	0x0000:  0082 1000 5542 5343 70a1 0200 0400 0000  ....UBSCp.......
	0x0010:  007e                                     .~