buglwIP - A Lightweight TCP/IP stack - Bugs: bug #53747, Bug in NetBIOS NS

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #53747: Bug in NetBIOS NS

Submitter:  Arkadiusz Wróbel <catsuryuu>
Submitted:  Wed 25 Apr 2018 06:23:02 AM UTC
   
 
Category:  Security-related Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  2.1.0
lwIP version:  git head

Wed 25 Apr 2018 06:57:16 PM UTC, comment #1: 

Fix pushed in b2ef9d90, thanks for reporting.

Simon Goldschmidt <goldsimon>
Group administrator
Wed 25 Apr 2018 06:23:02 AM UTC, original submission:  

The packet's size should be verified before casting to 'struct netbios_hdr *'.
Similarly with 'struct netbios_name_hdr *'.

I think p->tot_len should be at least 50 to work properly.

If an external host send a query with length equal to 48, two uninitialized bytes from heap will be send back to it (in 'cls' field).
I attached an example of the data leak in 'example_leak.pcapng' (0x4242 leaked from the previous packet).
I worked on 'echop' with 'echop_run_NBNS.patch'. The patch is only to trigger the bug.

[Related with: lwip/src/apps/netbiosns/netbiosns.c:343-344]

Arkadiusz Wróbel <catsuryuu>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #44018:  echop_run_NBNS.patch added by catsuryuu (579B - text/x-patch - The patch is only to trigger the bug.)
file #44019:  example_leak.pcapng added by catsuryuu (680B - application/x-pcapng - The patch is only to trigger the bug.)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by catsuryuu (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-04-25 goldsimon Planned ReleaseNone 2.1.0
    2018-04-25 goldsimon StatusNone Fixed
        Assigned toNone goldsimon
        Open/ClosedOpen Closed
    2018-04-25 catsuryuu Attached File- Added echop_run_NBNS.patch, #44018
        Attached File- Added example_leak.pcapng, #44019

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code