DataSoft/Honeyd — Issue #4: xp_print NULL in ICMP Timestamp probe / Bad OS fingerprinting
Author: PherricOxide
Created: 2012-02-01 21:19:13+00:00
State: open

While running a standard Nmap quick scan against a honeyd honeypot, a segfault can occur due to xp_print being NULL in the following code,

honeyd.c / icmp_recv_cb
/* YM: Add ICMP Timestamp reply capability */
case ICMP_TSTAMP:
/* Happens only if xp_print != NULL */
if (xp_print->flags.icmp_timestamp_reply) {
icmp_tstamp = (struct icmp_msg_timestamp *)
((u_char*)pkt + (ip->ip_hl << 2));

As of the latest commit, this has been temporarily fixed by returning if xp_print is NULL. However, this causes the OS service scan to not match 100% if we go down this branch.

This has only happened if the machine Nmap scanning the Honeypot is behind a NAT router.