[tcpdump/f21] Fix for CVE-2014-9140
Michal Sekletar
msekleta at fedoraproject.org
Wed Dec 10 12:11:01 UTC 2014
commit 4821efb245e583aa599606cffa3398b1901e96c5
Author: Michal Sekletar <msekleta at redhat.com>
Date: Wed Dec 3 16:23:55 2014 +0100
Fix for CVE-2014-9140
(cherry picked from commit 34303452e4286e4894117adbfa017897597cbbb6)
0016-Do-bounds-checking-when-unescaping-PPP.patch | 55 +++++++++++++++++++++
tcpdump.spec | 6 ++-
2 files changed, 60 insertions(+), 1 deletions(-)
---
diff --git a/0016-Do-bounds-checking-when-unescaping-PPP.patch b/0016-Do-bounds-checking-when-unescaping-PPP.patch
new file mode 100644
index 0000000..c10eb1b
--- /dev/null
+++ b/0016-Do-bounds-checking-when-unescaping-PPP.patch
@@ -0,0 +1,55 @@
+From 34303452e4286e4894117adbfa017897597cbbb6 Mon Sep 17 00:00:00 2001
+From: Guy Harris <guy at alum.mit.edu>
+Date: Wed, 22 Oct 2014 12:31:21 -0700
+Subject: [PATCH] Do bounds checking when unescaping PPP.
+
+Clean up a const issue while we're at it.
+---
+ print-ppp.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/print-ppp.c b/print-ppp.c
+index b858b73..eacba34 100644
+--- a/print-ppp.c
++++ b/print-ppp.c
+@@ -1351,14 +1351,15 @@ static void
+ ppp_hdlc(netdissect_options *ndo,
+ const u_char *p, int length)
+ {
+- u_char *b, *s, *t, c;
++ u_char *b, *t, c;
++ const u_char *s;
+ int i, proto;
+ const void *se;
+
+ if (length <= 0)
+ return;
+
+- b = (uint8_t *)malloc(length);
++ b = (u_char *)malloc(length);
+ if (b == NULL)
+ return;
+
+@@ -1367,14 +1368,13 @@ ppp_hdlc(netdissect_options *ndo,
+ * Do this so that we dont overwrite the original packet
+ * contents.
+ */
+- for (s = (u_char *)p, t = b, i = length; i > 0; i--) {
++ for (s = p, t = b, i = length; i > 0 && ND_TTEST(*s); i--) {
+ c = *s++;
+ if (c == 0x7d) {
+- if (i > 1) {
+- i--;
+- c = *s++ ^ 0x20;
+- } else
+- continue;
++ if (i <= 1 || !ND_TTEST(*s))
++ break;
++ i--;
++ c = *s++ ^ 0x20;
+ }
+ *t++ = c;
+ }
+--
+1.8.3.1
+
diff --git a/tcpdump.spec b/tcpdump.spec
index 46be859..94fcc42 100644
--- a/tcpdump.spec
+++ b/tcpdump.spec
@@ -2,7 +2,7 @@ Summary: A network traffic monitoring tool
Name: tcpdump
Epoch: 14
Version: 4.6.2
-Release: 2%{?dist}
+Release: 3%{?dist}
License: BSD with advertising
URL: http://www.tcpdump.org
Group: Applications/Internet
@@ -27,6 +27,7 @@ Patch0012: 0012-Clean-up-error-message-printing.patch
Patch0013: 0013-Further-cleanups.patch
Patch0014: 0014-Not-using-offsetof-any-more-so-no-need-for-stddef.h.patch
Patch0015: 0015-Report-a-too-long-unreachable-destination-list.patch
+Patch0016: 0016-Do-bounds-checking-when-unescaping-PPP.patch
%define tcpslice_dir tcpslice-1.2a3
@@ -89,6 +90,9 @@ exit 0
%{_mandir}/man8/tcpdump.8*
%changelog
+* Wed Dec 03 2014 Michal Sekletar <msekleta at redhat.com> - 14:4.6.2-3
+- fix for CVE-2014-9140
+
* Thu Nov 20 2014 Michal Sekletar <msekleta at redhat.com> - 14:4.6.2-2
- fix for CVE-2014-8767 (#1165160)
- fix for CVE-2014-8768 (#1165161)
More information about the scm-commits
mailing list