Project

General

Profile

Actions

Security #2887

closed

decode-ethernet: heapbuffer overflow in file decode-ethernet.c

Added by Jason Ish almost 6 years ago. Updated over 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Label:
Git IDs:

06f4da84ba563ec0dca0b1aa63d1fea1da3aa0cb

Severity:
Disclosure Date:

Description

From reporter:

## Input
Nearly the same as bug 2 but the type is an other, such that the DecodeEthernet(..) is executed e second time.
...
case ETHERNET_TYPE_DCE:
if (unlikely(len < ETHERNET_DCE_HEADER_LEN)) {
ENGINE_SET_INVALID_EVENT(p, DCE_PKT_TOO_SMALL);
} else {
DecodeEthernet(tv, dtv, p, pkt + ETHERNET_DCE_HEADER_LEN,
len - ETHERNET_DCE_HEADER_LEN, pq);
}
break ;
...
## Reason
If the package is exactly 28 long, in the first iteration you subtract 14 bytes. Than we have a packet length
of 14. At this point the case distinction says it is a valid packet. After that you cast the packet, but
This packet has not a type and the program will crash at the type case distinction.

If you proof the ethernet packets of a valid minimal max length, it would counter this types of bugs


Related issues 1 (0 open1 closed)

Copied to Suricata - Security #2946: decode-ethernet: heapbuffer overflow in file decode-ethernet.c (master)ClosedJason IshActions
Actions #1

Updated by Victor Julien over 5 years ago

  • Copied to Security #2946: decode-ethernet: heapbuffer overflow in file decode-ethernet.c (master) added
Actions #2

Updated by Victor Julien over 5 years ago

  • Status changed from Assigned to Closed
  • Priority changed from High to Normal
Actions #3

Updated by Victor Julien over 5 years ago

  • Private changed from Yes to No
Actions #4

Updated by Victor Julien over 4 years ago

  • Tracker changed from Bug to Security
  • CVE set to 2019-10056
  • Git IDs updated (diff)
Actions

Also available in: Atom PDF