lwIP - A Lightweight TCP/IP stack - Bugs: bug #24596, Vulnerability on faulty TCP...
You are not allowed to post comments on this tracker with your current authentication level.
bug #24596: Vulnerability on faulty TCP options length
| Submitter: | Simon Goldschmidt <goldsimon> | ||
| Submitted: | Fri 17 Oct 2008 07:17:20 PM UTC | ||
| Category: | TCP | Severity: | 3 - Normal |
| Item Group: | Faulty Behaviour | Status: | Fixed |
| Privacy: | Public | Assigned to: | goldsimon |
| Open/Closed: | Closed | Planned Release: | None |
| lwIP version: | 1.3.0 | ||
|
Mon 20 Oct 2008 12:20:36 PM UTC, comment #3: |
Simon Goldschmidt <goldsimon> |
|
Mon 20 Oct 2008 07:46:28 AM UTC, comment #2: I still think it is best practice to drop packets that do not conform to RFC 793.
|
TabascoEye <tabascoeye> |
|
Sat 18 Oct 2008 03:24:16 PM UTC, comment #1: The solution for this is really simple: the variable indexing the options was an u8_t. Adding an option-length of nearly 0xff lead to that u8_t overflowing which is why tcp_parseopt looped endlessly.
|
Simon Goldschmidt <goldsimon> |
|
Fri 17 Oct 2008 07:17:20 PM UTC, original submission:
Fabian Koch has reported this on lwip-devel:
|
Simon Goldschmidt <goldsimon> |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

The main reason for doing so is smaller code, I guess... I'd still vote for discarding malformed packets, but that's not really related to fixing this bug.