Hello While working on the FreeBSD Security Advisory for the recent tcpdump issues (CAN-2005-1278, CAN-2005-1279, and CAN-2005-1280) I noticed another similar infinite loop DoS vulnerability in the BGP handling code. It affects at least tcpdump 3.8.3 and tcpdump 3.9 snapshots from before May 5. The problem was in bgp_update_print() in print-bgp.c around line 1652 (for tcpdump 3.8.3), where the -1 return value from decode_prefix4() was not properly handled. The issue was verified to cause an infinite loop against tcpdump 3.8.3 running on FreeBSD (before FreeBSD-SA-05:10.tcpdump), which included the patches for the first set of tcpdump DoS vulnerabilities, and against a Gentoo Linux with tcpdump-3.8.3-r2 (Gentoo has released an update for GLSA-200505-06 which addresses the new issue). The very ugly proof-of-concept exploit code, which is based on bgp4_update.c from libnet, and the patch which fixes the problem (based on part of print-bgp.c v. 1.95) can be found at the URL's mentioned below. The proof-of-concept has been tested on FreeBSD using libnet 1.1.2.1. Note that this issue has been public for a bit and most major vendors has already release advisories for this issue, so this email is mainly to have a reference for the issue. This issue has been assigned the CVE name CAN-2005-1267. http://people.freebsd.org/~simon/security/CAN-2005-1267/tcpdump-bgp-update-poc.c http://people.freebsd.org/~simon/security/CAN-2005-1267/tcpdump-bgp-infinite-loop2.patch -- Simon L. Nielsen
Attachment:
pgpqNCjsaCQQt.pgp
Description: PGP signature