e-matters GmbH
                          www.e-matters.de

                      -= Security  Advisory =-



     Advisory: Multiple (13) Ethereal remote overflows
 Release Date: 2004/03/23
Last Modified: 2004/03/23
       Author: Stefan Esser [s.esser@e-matters.de]

  Application: Ethereal 0.8.14 - 0.10.2
     Severity: 13 remotely triggerable vulnerabilities were 
               discovered in the multiprotocol packet sniffer 
               Ethereal that allow remote compromise
         Risk: Critical
Vendor Status: Plans to release a fixed version within this week
    Reference: http://security.e-matters.de/advisories/032004.html


Overview:

   Quote from http://www.ethereal.com
   
   "Ethereal is used by network professionals around the world for 
   troubleshooting, analysis, software and protocol development, and 
   education. It has all of the standard features you would expect in 
   a protocol analyzer, and several features not seen in any other 
   product. Its open source license allows talented experts in the 
   networking community to add enhancements. It runs on all popular 
   computing platforms, including Unix, Linux, and Windows."
   
   During a code audit of Ethereal thirteen remotely triggerable stack-
   overflows where discovered. The vulnerable dissectors in question
   are namely: BGP, EIGRP, IGAP, IRDA, ISUP, NetFlow, PGM, TCAP and UCP.
   
   With the exception of 3 all discovered overflows allow arbitrary code
   execution by injecting carefully crafted packets to the sniffed wire
   or by convincing someone to load a malicious packet capture file into
   Ethereal.
   
      
Details:

   In the beginning of March a code audit of Ethereal revealed remotely
   triggerable overflows within a few of the over 400 dissectors. During
   the process of working with the Ethereal vendor the audit continued 
   and until today it was possible to identify a total count of 13 
   possible stack overflows within 9 different dissectors. 
   
   For the purpose of clarity it was choosen to describe all these bugs
   within this advisory instead of spreading the information over nine
   single advisories.
   
   Because the defects affect different parts of the code base and
   were introduced at different dates within the last 3 years the
   following table gives a short overview of the exact CVS commit
   timestamps and the version number it first appeared in.
   
   (Version 0.8.14)
   
   
   [04] EIGRP Dissector TLV_IP_INT Long IP Address Overflow
        - Revision: 1.7, Thu Nov 9 05:16:19 2000 UTC
   
   [05] EIGRP Dissector TLV_IP_EXT Long IP Address Overflow
        - Revision: 1.7, Thu Nov 9 05:16:19 2000 UTC
   
   
   (version 0.8.19)
   
   [06] PGM Dissector NakList Overflow
        - Revision: 1.1, Thu Jul 12 20:16:28 2001 UTC
   
   
   (version 0.9.0)
   
   [11] UCP Dissector Handle String-Field Overflow
        - Revision: 1.1, Mon Oct 8 17:30:23 2001 UTC
   
   [12] UCP Dissector Handle Int-Field Overflow
        - Revision: 1.1, Mon Oct 8 17:30:23 2001 UTC
   
   [13] UCP Dissector Handle Time-Field Overflow
        - Revision: 1.1, Mon Oct 8 17:30:23 2001 UTC
   
   
   (version 0.9.10)
   
   [01] Netflow v9 Dissector Template Caching Overflow
        - Revision 1.9 Tue Mar 4 03:37:12 2003 UTC
   
   
   (version 0.9.16)
   
   [09] ISUP Dissector INTERWORKING FUNCTION ADDRESS Overflow
        - Revision: 1.29, Fri Oct 3 20:58:13 2003 UTC
   
   [10] TCAP Dissector TID Overflow
        - Revision: 1.1, Thu Oct 2 06:13:28 2003 UTC
   
   
   (version 0.10.0)
   
   [02] IGAP Dissector Account Overflow 
        - Revision 1.1 Wed Dec 10 19:21:55 2003 UTC
   
   [03] IGAP Dissector Message Overflow 
        - Revision 1.1 Wed Dec 10 19:21:55 2003 UTC
   
   
   (version 0.10.1)
   
   [08] BGP Dissector MPLS Label Overflow
        - Revision: 1.84, Tue Jan 6 02:29:36 2004 UTC
   
   [07] IRDA Dissector Plugin IRCOM_PORT_NAME Overflow
        - Revision: 1.1, Thu Dec 18 19:07:12 2003 UTC
   
   
   
   In the following paragraphs all 13 bugs are described in a
   short form. The referenced URL within the header of this advisory
   will be updated with more detailed information (incl. snippets)
   when the Ethereal developers have released 0.10.3.

   
   [01] NetFlow v9 Dissector Template Caching Overflow
   ---------------------------------------------------
   
   Desc: When parsing the v9_template structure within a NetFlow
         UDP packet a template_entry count > 64 will overflow
         a stackbuffer and allows overwriting the saved instruction
         pointer, thus allowing remote code execution.


   [02] IGAP Protocol Dissector Account Overflow
   [03] IGAP Protocol Dissector Message Overflow
   ---------------------------------------------
   
   Desc: When parsing an IGAP protocol packet that contains either 
         an overlong accountname (>17) or an overlong message (>65)
         different buffers may overflow the stack, allowing an over-
         write of up to 238 (or 190) bytes. In both cases remote 
         code execution exploitation is possible.


   [04] EIGRP Protocol TLV_IP_INT Long IP Address Overflow
   -------------------------------------------------------

   Desc: When parsing an EIGRP IP packet that contains an overlong
         IP address this will overflow a stack buffer and therefore can
         lead to remote code execution

  
   [05] EIGRP Protocol TLV_IP_EXT Long IP Address Overflow
   -------------------------------------------------------

   Desc: When parsing an EIGRP Extended IP packet that contains an 
         overlong extended IP address this will overflow a stack buffer 
         and can lead to remote code execution


   [06] PGM Protocol NakList Overflow
   ----------------------------------

   Desc: When parsing an PGM packet with a carefully crafted NakList
         a possible integer underflow can result in a very small stack-
         overflow. Due to the stacklayout code execution exploitation
         seems very unlikely.


   [07] IRDA Protocol Plugin IRCOM_PORT_NAME Overflow
   --------------------------------------------------

   Desc: When parsing an IRCOM_PORT_NAME packed an overlong portname 
         can overwrite up to 2 bytes on the stack. Similar to [06] the
         stacklayout seems to make remote code execution very difficult
         or impossible.
  

   [08] BGP Protocol MPLS Label Overflow
   -------------------------------------
   
   Desc: When parsing a BGP Packet with a MPLS IPv6 label up to 13 
         bytes on the stack may be overwritten with arbitrary data.
         Due to the stacklayout exploitability seems unlikly and was
         therefore not tested.
      

   [09] ISUP Protocol INTERWORKING FUNCTION ADDRESS Overflow
   ---------------------------------------------------------

   Desc: When parsing an ISUP Packet an oversized IWFA will overflow 
         a stack buffer and can lead to remote code execution


   [10] TCAP Protocol TID Overflow
   -------------------------------
   
   Desc: When handling the ASN.1 encoded Transaction ID within a TCAP
         packet a 4 byte stack variable may overflow and can lead to
         remote code execution


   [11] UCP Protocol Handle String-Field Overflow
   ----------------------------------------------
   
   Desc: When handling a string within an UCP packet a stack buffer 
         of BUFSIZ bytes may overflow and can therefore lead to 
         remote code execution.
         To exploit this vulnerability over the wire an attacker must 
         be able to fit more than BUFSIZ bytes into one TCP packet.
         This means it is only exploitable on the wire if the system
         has a MTU bigger than BUFSIZ. BUFSIZ is 8192 on glibc 
         systems, 1024 on BSD systems and 512 on Windows systems.


   [12] UCP Protocol Handle Int-Field Overflow
   ----------------------------------------------
   
   Desc: When handling an Integer field within an UCP packet a stack 
         buffer of BUFSIZ bytes may overflow and can therfore lead to 
         remote code execution. 
         To exploit this vulnerability over the wire an attacker must 
         be able to fit more than BUFSIZ bytes into one TCP packet.
         This means it is only exploitable on the wire if the system
         has a MTU bigger than BUFSIZ. BUFSIZ is 8192 on glibc 
         systems, 1024 on BSD systems and 512 on Windows systems.


   [13] UCP Protocol Handle Time-Field Overflow
   ----------------------------------------------
   
   Desc: When handling a Time field within an UCP packet a stack 
         buffer of BUFSIZ bytes may overflow and can therefore lead 
         to remote code execution.
         To exploit this vulnerability over the wire an attacker must 
         be able to fit more than BUFSIZ bytes into one TCP packet.
         This means it is only exploitable on the wire if the system
         has a MTU bigger than BUFSIZ. BUFSIZ is 8192 on glibc 
         systems, 1024 on BSD systems and 512 on Windows systems.


Proof of Concept:

   e-matters is not going to release an exploit for any of these 
   vulnerabilities to the public. 
  

Disclosure Timeline:

    5. March 2004 - Ethereal developers were contacted by email
                    telling them about 10(of the 13) holes.
                    6 holes were closed the same day EIGRP, IGAP,
                    ISUP and BGP.
    7. March 2004 - IRDA hole closed (after checking specs)
    8. March 2004 - PGM hole closed (after checking specs)
    9. March 2004 - NetFlow hole closed (after checking specs)
   17. March 2004 - UCP holes were discovered and mailed to vendor
   19. March 2004 - UCP and TCAP holes closed (after checking specs)
   22. March 2004 - Ethereal developers have releases a mini advisory
                    urging their users to upgrade to version 0.10.3
                    which will be released later this week
   23. March 2004 - Public Disclosure


CVE Information:

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has
   assigned the name CAN-2004-0176 to this issue.


Recommendation:

   Until you can upgrade to version 0.10.3 of Ethereal or to the 
   bugfixed package from your distributor it is strongly recommended
   to disable the following dissectors in the menu:
   
   Analyze->Enabled Protocols
   
   disable: BGP, EIGRP, IGAP, IRDA, ISUP, NetFlow, PGM, TCAP, UCP
   
   
GPG-Key:

   http://security.e-matters.de/gpg_key.asc
    
   pub  1024D/75E7AAD6 2002-02-26 e-matters GmbH - Securityteam
   Key fingerprint = 43DD 843C FAB9 832A E5AB  CAEB 81F2 8110 75E7 AAD6


Copyright 2004 Stefan Esser. All rights reserved.


-- 

--------------------------------------------------------------------------
 Stefan Esser                                        s.esser@e-matters.de
 e-matters Security                         http://security.e-matters.de/

 GPG-Key                gpg --keyserver pgp.mit.edu --recv-key 0xCF6CAE69 
 Key fingerprint       B418 B290 ACC0 C8E5 8292  8B72 D6B0 7704 CF6C AE69
--------------------------------------------------------------------------
 Did I help you? Consider a gift:            http://wishlist.suspekt.org/
--------------------------------------------------------------------------