Skip to content

Commit f76e7fe

Browse files
guyharrisinfrastation
authored andcommitted
CVE-2017-12896/ISAKMP: Do bounds checks in isakmp_rfc3948_print().
This fixes a buffer over-read discovered by Kamil Frankowicz. Add a test using the capture file supplied by the reporter(s).
1 parent a1eefe9 commit f76e7fe

File tree

4 files changed

+70
-1
lines changed

4 files changed

+70
-1
lines changed

Diff for: print-isakmp.c

+2-1
Original file line numberDiff line numberDiff line change
@@ -3041,7 +3041,7 @@ isakmp_rfc3948_print(netdissect_options *ndo,
30413041
const u_char *bp, u_int length,
30423042
const u_char *bp2)
30433043
{
3044-
3044+
ND_TCHECK(bp[0]);
30453045
if(length == 1 && bp[0]==0xff) {
30463046
ND_PRINT((ndo, "isakmp-nat-keep-alive"));
30473047
return;
@@ -3050,6 +3050,7 @@ isakmp_rfc3948_print(netdissect_options *ndo,
30503050
if(length < 4) {
30513051
goto trunc;
30523052
}
3053+
ND_TCHECK(bp[3]);
30533054

30543055
/*
30553056
* see if this is an IKE packet

Diff for: tests/TESTLIST

+1
Original file line numberDiff line numberDiff line change
@@ -441,6 +441,7 @@ isoclns-heapoverflow-3 isoclns-heapoverflow-3.pcap isoclns-heapoverflow-3.out -e
441441
stp-v4-length-sigsegv stp-v4-length-sigsegv.pcap stp-v4-length-sigsegv.out
442442
hoobr_pimv1 hoobr_pimv1.pcap hoobr_pimv1.out
443443
hoobr_safeputs hoobr_safeputs.pcap hoobr_safeputs.out
444+
isakmp-rfc3948-oobr isakmp-rfc3948-oobr.pcap isakmp-rfc3948-oobr.out
444445

445446
# bad packets from Wilfried Kirsch
446447
slip-bad-direction slip-bad-direction.pcap slip-bad-direction.out -ve

Diff for: tests/isakmp-rfc3948-oobr.out

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
2+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
3+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
4+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
5+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
6+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
7+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
8+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
9+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
10+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
11+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
12+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
13+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
14+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
15+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
16+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
17+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
18+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
19+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
20+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
21+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
22+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
23+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
24+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
25+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
26+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
27+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
28+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
29+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
30+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
31+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
32+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
33+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
34+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
35+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
36+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
37+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
38+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
39+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
40+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
41+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
42+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
43+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
44+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
45+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
46+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
47+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
48+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
49+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
50+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
51+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
52+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
53+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
54+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
55+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
56+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
57+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
58+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
59+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
60+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
61+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
62+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
63+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
64+
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432:
65+
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
66+
0x0010: 3030 3030 3030 3030 3030 3030 000000000000
67+
IP 48.48.48.48.4500 > 48.48.48.48.12336: [|isakmp]

Diff for: tests/isakmp-rfc3948-oobr.pcap

5.36 KB
Binary file not shown.

0 commit comments

Comments
 (0)