CVE-2017-13004 (published 2017-09-14T06:29Z)

The Juniper protocols parser in tcpdump before 4.9.2 has a buffer over-read in print-juniper.c:juniper_parse_header().

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/the-tcpdump-group/tcpdump
commit_details: repo_url: https://github.com/the-tcpdump-group/tcpdump
author: Guy Harris
author_date: 2017-02-21 14:20:32-08:00
msg: CVE-2017-13004/Juniper: Add a bounds check.

This fixes a buffer over-read discovered by Forcepoint's security
researchers Otto Airamo & Antti Levomäki.

Add tests using the capture files supplied by the reporter(s).
repository: repo_url: https://github.com/the-tcpdump-group/tcpdump
repo_name: the-tcpdump-group/tcpdump
description: the TCPdump network dissector
repo_language: C
owner: the-tcpdump-group
file_changes: filename: print-juniper.c
change_type: ModificationType.MODIFY
diff: @@ -1367,6 +1367,7 @@ juniper_parse_header(netdissect_options *ndo,
             if (ndo->ndo_eflag) ND_PRINT((ndo, ": ")); /* print demarc b/w L2/L3*/
 
 
+            ND_TCHECK_16BITS(p+l2info->cookie_len);
             l2info->proto = EXTRACT_16BITS(p+l2info->cookie_len);
             break;
         }

programming_language: C
filename: TESTLIST
change_type: ModificationType.MODIFY
diff: @@ -493,6 +493,8 @@ pimv2-oobr-4		pimv2-oobr-4.pcap		pimv2-oobr-4.out		-vvv -e
 802_15_4-data		802_15_4-data.pcap		802_15_4-data.out	-vvv -e
 802_15_4_beacon		802_15_4_beacon.pcap		802_15_4_beacon.out	-vvv -e
 lmpv1_busyloop		lmpv1_busyloop.pcap		lmpv1_busyloop.out	-vvv -e
+juniper_atm1		juniper_atm1.pcap		juniper_atm1.out	-vvv -e
+juniper_es		juniper_es.pcap			juniper_es.out	-vvv -e
 
 # RTP tests
 # fuzzed pcap

programming_language: Shell
filename: juniper_atm1.out
change_type: ModificationType.ADD
diff: @@ -0,0 +1,2 @@
+Out 
+	Juniper PCAP Flags [none]ATM1-PIC, cookie-len 4, cookie 0x30303030: [|juniper_hdr], length 808464432

programming_language: Batchfile
filename: juniper_es.out
change_type: ModificationType.ADD
diff: @@ -0,0 +1,2 @@
+Out 
+	Juniper PCAP Flags [none]ES-PIC, cookie-len 0: [|juniper_hdr], length 808464432

programming_language: Batchfile
repo_url: https://github.com/the-tcpdump-group/tcpdump
commit_details: repo_url: https://github.com/the-tcpdump-group/tcpdump
author: Guy Harris
author_date: 2017-02-22 01:24:45-08:00
msg: CVE-2017-13004/Juniper: Add a capture file.

File from Kamil Frankowicz testing an existing fix.

(Same problem, and same fix, as the recent Juniper fixes.)
repository: repo_url: https://github.com/the-tcpdump-group/tcpdump
repo_name: the-tcpdump-group/tcpdump
description: the TCPdump network dissector
repo_language: C
owner: the-tcpdump-group
file_changes: filename: TESTLIST
change_type: ModificationType.MODIFY
diff: @@ -454,6 +454,7 @@ hoobr_ripng_print	hoobr_ripng_print.pcap		hoobr_ripng_print.out
 hoobr_juniper		hoobr_juniper.pcap		hoobr_juniper.out
 hoobr_juniper2		hoobr_juniper2.pcap		hoobr_juniper2.out
 hoobr_juniper3		hoobr_juniper3.pcap		hoobr_juniper3.out
+hoobr_juniper4		hoobr_juniper4.pcap		hoobr_juniper4.out
 hoobr_parse_field	hoobr_parse_field.pcap		hoobr_parse_field.out
 hoobr_chdlc_print	hoobr_chdlc_print.pcap		hoobr_chdlc_print.out
 hoobr_lookup_nsap	hoobr_lookup_nsap.pcap		hoobr_lookup_nsap.out

programming_language: Shell
filename: hoobr_juniper4.out
change_type: ModificationType.ADD
diff: @@ -0,0 +1 @@
+[|juniper_hdr], length 808464432

programming_language: Batchfile