CVE-2017-12987 (published 2017-09-14T06:29Z)

The IEEE 802.11 parser in tcpdump before 4.9.2 has a buffer over-read in print-802_11.c:parse_elements().

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/the-tcpdump-group/tcpdump
commit_details: repo_url: https://github.com/the-tcpdump-group/tcpdump
author: Guy Harris
author_date: 2017-02-06 11:24:42-08:00
msg: CVE-2017-12987/IEEE 802.11: Fix processing of TIM IE.

The arguments to memcpy() were completely wrong.

This fixes a buffer over-read discovered by Kamil Frankowicz.

Add a test using the capture file supplied by Brian 'geeknik' Carpenter.
repository: repo_url: https://github.com/the-tcpdump-group/tcpdump
repo_name: the-tcpdump-group/tcpdump
description: the TCPdump network dissector
repo_language: C
owner: the-tcpdump-group
file_changes: filename: print-802_11.c
change_type: ModificationType.MODIFY
diff: @@ -1189,8 +1189,7 @@ parse_elements(netdissect_options *ndo,
 			offset += 3;
 			length -= 3;
 
-			memcpy(tim.bitmap, p + (tim.length - 3),
-			    (tim.length - 3));
+			memcpy(tim.bitmap, p + offset + 3, tim.length - 3);
 			offset += tim.length - 3;
 			length -= tim.length - 3;
 			/*

programming_language: C
filename: TESTLIST
change_type: ModificationType.MODIFY
diff: @@ -435,6 +435,7 @@ atm-heapoverflow	atm-heapoverflow.pcap		atm-heapoverflow.out		-c1 -e
 ipv6-next-header-oobr-1	ipv6-next-header-oobr-1.pcap	ipv6-next-header-oobr-1.out
 ipv6-next-header-oobr-2	ipv6-next-header-oobr-2.pcap	ipv6-next-header-oobr-2.out
 ipv6-rthdr-oobr		ipv6-rthdr-oobr.pcap		ipv6-rthdr-oobr.out
+ieee802.11_tim_ie_oobr	ieee802.11_tim_ie_oobr.pcap	ieee802.11_tim_ie_oobr.out
 
 # bad packets from Kamil Frankowicz
 snmp-heapoverflow-1	snmp-heapoverflow-1.pcap	snmp-heapoverflow-1.out

programming_language: Shell
filename: ieee802.11_tim_ie_oobr.out
change_type: ModificationType.ADD
diff: @@ -0,0 +1,4 @@
+ReAssoc Response AID(3030) : PRIVACY : n/a[|802.11]
+ReAssoc Response AID(3030) : PRIVACY : n/a[|802.11]
+[|802.11]
+ReAssoc Response AID(3030) : PRIVACY : n/a[|802.11]

programming_language: Markdown
repo_url: https://github.com/the-tcpdump-group/tcpdump
commit_details: repo_url: https://github.com/the-tcpdump-group/tcpdump
author: Guy Harris
author_date: 2017-02-06 16:16:24-08:00
msg: CVE-2017-12987/Another test for the TIM IE bug, from Kamil Frankowicz.
repository: repo_url: https://github.com/the-tcpdump-group/tcpdump
repo_name: the-tcpdump-group/tcpdump
description: the TCPdump network dissector
repo_language: C
owner: the-tcpdump-group
file_changes: filename: TESTLIST
change_type: ModificationType.MODIFY
diff: @@ -449,6 +449,7 @@ isakmp-rfc3948-oobr	isakmp-rfc3948-oobr.pcap	isakmp-rfc3948-oobr.out
 isoclns-oobr		isoclns-oobr.pcap		isoclns-oobr.out
 nfs-attr-oobr		nfs-attr-oobr.pcap		nfs-attr-oobr.out
 decnet-oobr		decnet-oobr.pcap		decnet-oobr.out
+oobr_parse_elements	oobr_parse_elements.pcap	oobr_parse_elements.out
 
 # bad packets from Wilfried Kirsch
 slip-bad-direction	slip-bad-direction.pcap		slip-bad-direction.out	-ve

programming_language: Shell
filename: oobr_parse_elements.out
change_type: ModificationType.ADD
diff: @@ -0,0 +1 @@
+Beacon IBSS, PRIVACY[|802.11]

programming_language: SQL