CVE-2017-13047 (published 2017-09-14T06:29Z)

The ISO ES-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:esis_print().

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/the-tcpdump-group/tcpdump
commit_details: repo_url: https://github.com/the-tcpdump-group/tcpdump
author: Denis Ovsienko
author_date: 2017-08-06 20:54:42+01:00
msg: CVE-2017-13047/ES-IS: put an existing bounds check right

The bounds check in esis_print() tested one pointer at the beginning of
a loop that incremented another, make the trivial fix. While at it, make
the function print a standard marker when it detects truncated data and
update some existing ES-IS tests respectively.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s).
repository: repo_url: https://github.com/the-tcpdump-group/tcpdump
repo_name: the-tcpdump-group/tcpdump
description: the TCPdump network dissector
repo_language: C
owner: the-tcpdump-group
file_changes: filename: print-isoclns.c
change_type: ModificationType.MODIFY
diff: @@ -1334,7 +1334,7 @@ esis_print(netdissect_options *ndo,
 
             case ESIS_OPTION_PROTOCOLS:
                 while (opli>0) {
-                    ND_TCHECK(*pptr);
+                    ND_TCHECK(*tptr);
                     ND_PRINT((ndo, "%s (0x%02x)",
                            tok2str(nlpid_values,
                                    "unknown",
@@ -1367,7 +1367,7 @@ esis_print(netdissect_options *ndo,
             pptr += opli;
         }
 trunc:
-	return;
+        ND_PRINT((ndo, "[|esis]"));
 }
 
 static void

programming_language: C
filename: TESTLIST
change_type: ModificationType.MODIFY
diff: @@ -566,6 +566,7 @@ vqp-oobr		vqp-oobr.pcap			vqp-oobr.out		-v -c1
 bgp_pmsi_tunnel-oobr	bgp_pmsi_tunnel-oobr.pcap	bgp_pmsi_tunnel-oobr.out -v -c1
 bgp_mvpn_6_and_7	bgp_mvpn_6_and_7.pcap		bgp_mvpn_6_and_7.out	-v -c1
 rsvp_fast_reroute-oobr	rsvp_fast_reroute-oobr.pcap	rsvp_fast_reroute-oobr.out -v -c1
+esis_opt_prot-oobr	esis_opt_prot-oobr.pcap		esis_opt_prot-oobr.out	-v -c1
 
 # bad packets from Katie Holly
 mlppp-oobr		mlppp-oobr.pcap			mlppp-oobr.out

programming_language: Shell
filename: esis_opt_prot-oobr.out
change_type: ModificationType.ADD
diff: @@ -0,0 +1,5 @@
+ES-IS, length 33559803
+	redirect (6), v: 1, checksum: 0x00c6 (unverified), holding time: 2303s, length indicator: 54
+	  00.8e
+	  SNPA (length: 0): <empty>
+	  Protocols supported Option #129, length 11, value: CLNP (0x81), [|esis]

programming_language: Markdown
filename: esis_snpa_asan-3.out
change_type: ModificationType.MODIFY
diff: @@ -4,4 +4,4 @@ UI 22! ES-IS, length 65565
 UI 22! ES-IS, length 2650865693
 	redirect (6), v: 1, checksum: 0x0300 (incorrect should be 0xbce5), holding time: 21480s, length indicator: 17
 	  ec.ff00.00
-	  SNPA (length: 0): <empty>
+	  SNPA (length: 0): <empty>[|esis]

programming_language: Markdown
filename: esis_snpa_asan-4.out
change_type: ModificationType.MODIFY
diff: @@ -7,7 +7,7 @@ UI 22! ES-IS, length 65565
 	redirect (6), v: 1, checksum: 0x7034 (incorrect should be 0x44ec), holding time: 21315s, length indicator: 16
 	  02.0400
 	  SNPA (length: 0): <empty>
-	  Unknown Option #0, length 0, value: 
+	  Unknown Option #0, length 0, value: [|esis]
 UI 32! ES-IS, length 65565
 	ESH (2), v: 1, checksum: 0x70a1 (incorrect should be 0xfb4e), holding time: 21315s, length indicator: 17
 	  Number of Source Addresses: 2
@@ -17,5 +17,5 @@ UI 22! ES-IS, length 4244701213
 	redirect (6), v: 1, checksum: 0x7034 (incorrect should be 0x36fe), holding time: 21315s, length indicator: 17
 	  isonsap_string: illegal length
 	  SNPA (length: 0): <empty>
-	  NET (length: 4) 00.0000.00
+	  NET (length: 4) 00.0000.00[|esis]
 Q.922, invalid address

programming_language: Scala
filename: esis_snpa_asan-5.out
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@ UI 22! ES-IS, length 65565
 	  Number of Source Addresses: 3
 	  NET (length: 0): isonsap_string: illegal length
 	  NET (length: 4): ec.ff00.00
-	  NET (length: 0): isonsap_string: illegal length
+	  NET (length: 0): isonsap_string: illegal length[|esis]
 UI 22! ES-IS, length 65565
 	redirect (6), v: 1, checksum: 0x7034 (incorrect should be 0x3ff0), holding time: 21315s, length indicator: 17
 	  04

programming_language: Scala