Bug 80582 (CVE-2005-1281)

======================================================
Candidate: CAN-2005-1278
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1278
Reference: BUGTRAQ:20050426 tcpdump[v3.8.x/v3.9.1]: ISIS, BGP, and LDP infinite
loop DOS exploits.
Reference: URL:http://www.securityfocus.com/archive/1/396932

The isis_print function, as called by isoclns_print, in tcpdump 3.9.1
and earlier allows remote attackers to cause a denial of service
(infinite loop) via a zero length, as demonstrated using a GRE packet.


======================================================
Candidate: CAN-2005-1279
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1279
Reference: BUGTRAQ:20050426 tcpdump[v3.8.x/v3.9.1]: ISIS, BGP, and LDP infinite
loop DOS exploits.
Reference: URL:http://www.securityfocus.com/archive/1/396932

tcpdump 3.8.3 and earlier allows remote attackers to cause a denial of
service (infinite loop) via a crafted (1) BGP packet, which is not
properly handled by RT_ROUTING_INFO, or (2) LDP packet, which is not
properly handled by the ldp_print function.


======================================================
Candidate: CAN-2005-1280
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1280
Reference: BUGTRAQ:20050426 tcpdump(/ethereal)[]: (RSVP) rsvp_print() infinite
loop DOS.
Reference: URL:http://www.securityfocus.com/archive/1/396930

The rsvp_print function in tcpdump 3.9.1 and earlier allows remote
attackers to cause a denial of service (infinite loop) via a crafted
RSVP packet of length 4.


======================================================
Candidate: CAN-2005-1281
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1281
Reference: BUGTRAQ:20050426 tcpdump(/ethereal)[]: (RSVP) rsvp_print() infinite
loop DOS.
Reference: URL:http://www.securityfocus.com/archive/1/396930

Ethereal 0.10.10 and earlier allows remote attackers to cause a denial
of service (infinite loop) via a crafted RSVP packet of length 4.

Any news here? Was there a patch discussed on tcpdump list or website?

For 9.3, 9.2 and SLES9/9.1 fixed all, for 9.0, 8.2 and SLES8 only CAN-2005-1279
and a piece of CAN-2005-1278 not actualy related to LDP seems to apply, please
review the patches.

Created attachment 37179 [details]
patches.tar.gz

patches.tar.gz

packages submited

SM-Tracker-1215 

did you write the patches yourself or are they taken from upstream? 

Another similar bug in same code: 
 
Date: Tue, 31 May 2005 00:49:19 +0200                                                                                                  
From: "Simon L. Nielsen" <simon@FreeBSD.org>                                                                                           
To: vendor-sec@lst.de                                                                                                                  
Cc: Guy Harris <guy@alum.mit.edu>,                                                                                                     
        FreeBSD Security Team <security-team@FreeBSD.org>                                                                              
Subject: [vendor-sec] Another tcpdump BGP infinite loop vulnerability                                                                  
 
[I have CC'ed Guy Harris since he made the commit to tcpdump 3.9 which 
fixes this problem] 
 
Hello 
 
While working on the FreeBSD Security Advisory for the recent tcpdump 
issues (CAN-2005-1278, CAN-2005-1279, and CAN-2005-1280) I noticed 
that there is another similar infinite loop DoS vulnerability in the 
BGP handling code. 
 
The problem lies in bgp_update_print() in print-bgp.c around line 
1652, where the -1 return value from decode_prefix4() is not properly 
handled. 
 
This problem was fixed in tcpdump CVS repository in print-bgp.c 
v. 1.95 on May 5, but it hasn't gone to the tcpdump 3.8 branch, and 
hasn't been included in any of the vendor patch sets for earlier DoS 
vulnerabilities that I have seen. 
 
I have verified that the infinite loop indeed can be exploited against 
tcpdump 3.8.3 on FreeBSD, which included the patches for the already 
public DoS vulnerabilities, and against a Gentoo Linux with 
tcpdump-3.8.3-r2, which should be fixed according to GLSA-200505-06. 
 
I have attached my very ugly proof-of-concept exploit code (which is 
based on bgp4_update.c from libnet) and the patch which fixes the 
problem (based on part of print-bgp.c v. 1.95).  The proof-of-concept 
has been tested on FreeBSD using libnet 1.1.2.1. 
 
I have not made this public yet, but it is semi-public since it has 
been fixed in the public tcpdump CVS tree.  Personally I don't know if 
a (short) embargo is needed - I'm open to suggestions, but please 
don't publish this info until an embargo date (or no embargo) has been 
agreed on - thanks. 
 
This issue is similar to CAN-2005-1279, so I don't know if that CVE 
name should be used or a new one should to be assigned. 
 
I'm not on directly vendor-sec myself, so please keep me in CC. 
 
--                                                                                                                                     
Simon L. Nielsen                                                                                                                       
FreeBSD Security Team 

Created attachment 38363 [details]
tcpdump-bgp-infinite-loop2.patch

Created attachment 38364 [details]
tcpdump-bgp-update-poc.c

CAN-2005-1267 

taken from upstream and adapted to patch the older versions

submited fixes for 9.2 and 9.3, older distributions seem unaffected

OK, thanks. The SLEC version is missing, please submit also a patched version 
for /work/SRC/old-versions/8.1/SLEC/all/tcpdump. 

please coalesce both SLEC and UL1 version, they should not be different I 
think 

OK. Done. 

The patchinfo for SLEC is not neeccessary now, right?

sles8-slec-i386 needs to be mentioned still, but no extra package is 
necessarey. 
 
btw, since this is just 1 package , you can write 2 patchinfos: 
1 for all maintained products (sles...) 
1 for all box products (x.x-i386/x.x-x856_64) 
 
btw, please priorize sudo higher than this issue. 

*** Bug 91571 has been marked as a duplicate of this bug. ***

packages released

CVE-2005-1281: CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)