CVE-2017-13001 (Other, published 2017-09-14T06:29Z)
Description: value: The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:nfs_printfh().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-nfs.c
tests/TESTLIST
tests/hoobr_nfs_printfh.out
Commit message: CVE-2017-13001/NFS: Don't copy more data than is in the file handle.

Also, put the buffer on the stack; no reason to make it static.  (65
bytes isn't a lot.)

This fixes a buffer over-read discovered by Kamil Frankowicz.

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:
		static char temp[NFSX_V3FHMAX+1];
		strncpy(temp, sfsname, NFSX_V3FHMAX);
		temp[sizeof(temp) - 1] = '\0';

Fixed code:
		char temp[NFSX_V3FHMAX+1];
		u_int stringlen;
		stringlen = len;
		if (stringlen > NFSX_V3FHMAX)
			stringlen = NFSX_V3FHMAX;
		strncpy(temp, sfsname, stringlen);
		temp[stringlen] = '\0';
hoobr_nfs_printfh	hoobr_nfs_printfh.pcap		hoobr_nfs_printfh.out
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0010:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0020:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0030:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0040:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0050:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0060:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0070:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0080:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0090:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00a0:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00b0:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00c0:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00d0:  3030 3030 3030 3030 3030 3030            000000000000
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0010:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0020:  3030 3030 3030 3030                      00000000
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0010:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0020:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0030:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0040:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0050:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0060:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0070:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0080:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0090:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00a0:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00b0:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00c0:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0010:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0020:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0030:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0040:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0050:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0060:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0070:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0080:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0090:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00a0:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00b0:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00c0:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00d0:  3030 3030 3030 3030 3030 3030            000000000000
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0010:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0020:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0030:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0040:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0050:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0060:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0070:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0080:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0090:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00a0:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00b0:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00c0:  3030 3030                                0000
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0010:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0020:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0030:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0040:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0050:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0060:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0070:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0080:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0090:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00a0:  3030 3030                                0000
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0010:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0020:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0030:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0040:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0050:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0060:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0070:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0080:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0090:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00a0:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00b0:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00c0:  3030 3030 3030 3030 3030 3030            000000000000
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0010:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0020:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0030:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0040:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0050:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0060:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0070:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0080:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0090:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00a0:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00b0:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00c0:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x00d0:  3030 3030 3030 3030 3030 3030            000000000000
IP 48.48.48.48.12336 > 48.48.48.48.2049: Flags [.U], seq 808464432:808476728, ack 808464432, win 12336, urg 12336, length 12296: NFS request xid 808464432 12292 readlink fh 00000000/808464432