lwIP - A Lightweight TCP/IP stack - Bugs: bug #24596, Vulnerability on faulty TCP...
You are not allowed to post comments on this tracker with your current authentication level.
bug #24596: Vulnerability on faulty TCP options length
Submitter: | Simon Goldschmidt <goldsimon> | ||
Submitted: | Fri 17 Oct 2008 07:17:20 PM UTC | ||
Category: | TCP | Severity: | 3 - Normal |
Item Group: | Faulty Behaviour | Status: | Fixed |
Privacy: | Public | Assigned to: | goldsimon |
Open/Closed: | Closed | Planned Release: | None |
lwIP version: | 1.3.0 |
Mon 20 Oct 2008 12:20:36 PM UTC, comment #3: |
Simon Goldschmidt <goldsimon> |
Mon 20 Oct 2008 07:46:28 AM UTC, comment #2: I still think it is best practice to drop packets that do not conform to RFC 793.
|
TabascoEye <tabascoeye> |
Sat 18 Oct 2008 03:24:16 PM UTC, comment #1: The solution for this is really simple: the variable indexing the options was an u8_t. Adding an option-length of nearly 0xff lead to that u8_t overflowing which is why tcp_parseopt looped endlessly.
|
Simon Goldschmidt <goldsimon> |
Fri 17 Oct 2008 07:17:20 PM UTC, original submission:
Fabian Koch has reported this on lwip-devel:
|
Simon Goldschmidt <goldsimon> |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 4 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2009-01-21 | goldsimon | Open/Closed | Open | Closed | |
2009-01-21 | goldsimon | Status | Ready For Test | Fixed | |
2008-10-18 | goldsimon | Status | None | Ready For Test | |
Assigned to | None | goldsimon |
Powered by Savane 3.13-02a9.
Corresponding source code
The main reason for doing so is smaller code, I guess... I'd still vote for discarding malformed packets, but that's not really related to fixing this bug.