Another tcpdump BGP infinite loop vulnerability (CAN-2005-1267)

Hello

While working on the FreeBSD Security Advisory for the recent tcpdump
issues (CAN-2005-1278, CAN-2005-1279, and CAN-2005-1280) I noticed
another similar infinite loop DoS vulnerability in the BGP handling
code. It affects at least tcpdump 3.8.3 and tcpdump 3.9 snapshots
from before May 5.

The problem was in bgp_update_print() in print-bgp.c around line 1652
(for tcpdump 3.8.3), where the -1 return value from decode_prefix4()
was not properly handled.

The issue was verified to cause an infinite loop against tcpdump 3.8.3
running on FreeBSD (before FreeBSD-SA-05:10.tcpdump), which included
the patches for the first set of tcpdump DoS vulnerabilities, and
against a Gentoo Linux with tcpdump-3.8.3-r2 (Gentoo has released an
update for GLSA-200505-06 which addresses the new issue).

The very ugly proof-of-concept exploit code, which is based on
bgp4_update.c from libnet, and the patch which fixes the problem
(based on part of print-bgp.c v. 1.95) can be found at the URL's
mentioned below. The proof-of-concept has been tested on FreeBSD
using libnet 1.1.2.1.

Note that this issue has been public for a bit and most major vendors
has already release advisories for this issue, so this email is mainly
to have a reference for the issue.

This issue has been assigned the CVE name CAN-2005-1267.

http://people.freebsd.org/~simon/security/CAN-2005-1267/tcpdump-bgp-update-poc.c
http://people.freebsd.org/~simon/security/CAN-2005-1267/tcpdump-bgp-infinite-loop2.patch

–
Simon L. Nielsen