suricata: CVE-2017-7177: IPv4 defrag evasion issue

Debian Bug report logs - #856649
suricata: CVE-2017-7177: IPv4 defrag evasion issue

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: suricata: IPv4 defrag evasion issue

Date: Fri, 03 Mar 2017 10:45:32 +0100

Source: suricata
Version: 2.0.7-2
Severity: important
Tags: patch upstream security
Forwarded: https://redmine.openinfosecfoundation.org/issues/2019

Details:

https://redmine.openinfosecfoundation.org/issues/2019
Fixed by:
https://github.com/inliniac/suricata/commit/4a04f814b15762eb446a5ead4d69d021512df6f8
(3.2.1)

No CVE assigned yet. Can you please update the bug once known.

Regards,
Salvatore

Message #12 received at 856649@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: 856649@bugs.debian.org

Cc: Salvatore Bonaccorso <carnil@debian.org>

Subject: Re: suricata: IPv4 defrag evasion issue

Date: Wed, 15 Mar 2017 07:36:26 +0000

Hi,

> suricata: IPv4 defrag evasion issue

Any update with getting a CVE on this? :)


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #17 received at 856649@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Chris Lamb <lamby@debian.org>

Cc: 856649@bugs.debian.org

Subject: Re: suricata: IPv4 defrag evasion issue

Date: Wed, 15 Mar 2017 10:21:24 +0100

Hello Chris,

On Wed, Mar 15, 2017 at 07:36:26AM +0000, Chris Lamb wrote:
> Hi,
> 
> > suricata: IPv4 defrag evasion issue
> 
> Any update with getting a CVE on this? :)

No, unfortuantely we haven't heard back yet.

Regards,
Salvatore

Message #22 received at 856649@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Chris Lamb <lamby@debian.org>, 856649@bugs.debian.org

Subject: Re: Bug#856649: suricata: IPv4 defrag evasion issue

Date: Sun, 19 Mar 2017 20:22:13 +0100

Control: retitle -1 suricata: CVE-2017-7177: IPv4 defrag evasion issue

On Wed, Mar 15, 2017 at 07:36:26AM +0000, Chris Lamb wrote:
> Hi,
> 
> > suricata: IPv4 defrag evasion issue
> 
> Any update with getting a CVE on this? :)

It's CVE-2017-7177. I have updated the security-tracker.

Regards,
Salvatore

Message #29 received at 856649@bugs.debian.org (full text, mbox, reply):

From: Arturo Borrero Gonzalez <arturo@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: Chris Lamb <lamby@debian.org>, 856649@bugs.debian.org

Subject: Re: Bug#856649: suricata: IPv4 defrag evasion issue

Date: Mon, 20 Mar 2017 14:29:53 +0100

On 19 March 2017 at 20:22, Salvatore Bonaccorso <carnil@debian.org> wrote:
>
> It's CVE-2017-7177. I have updated the security-tracker.
>

Yes, thanks Salvatore. All seems right.

The upload with the fix is in unstable, in his way for stretch.

I would like to ask, What are your plans regarding wheezy?

Message #34 received at 856649@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: Arturo Borrero Gonzalez <arturo@debian.org>, Salvatore Bonaccorso <carnil@debian.org>

Cc: 856649@bugs.debian.org

Subject: Re: Bug#856649: suricata: IPv4 defrag evasion issue

Date: Mon, 20 Mar 2017 16:36:39 +0000

Hi Arturo,

> I would like to ask, What are your plans regarding wheezy?

Just jumping in here as I just had a look at backporting this patch. I
think there might be some issues with the upstream patch anyway, eg.:

 https://github.com/inliniac/suricata/commit/4a04f814b15762eb446a5ead4d69d021512df6f8#commitcomment-21401303

Apart from that, how about:

    --- suricata-1.2.1.orig/src/defrag.c
    +++ suricata-1.2.1/src/defrag.c
    @@ -174,6 +174,8 @@ typedef struct DefragTracker_ {
         uint32_t id; /**< IP ID for this tracker.  32 bits for IPv6, 16
                       * for IPv4. */
     
    +    uint8_t proto; /**< IP protocol for this tracker. */
    +
         uint8_t policy; /**< Reassembly policy this tracker will use. */
     
         uint8_t af; /**< Address family for this tracker, AF_INET or
    @@ -268,6 +270,8 @@ DefragHashCompare(void *a, uint16_t a_le
             return 0;
         else if (!CMP_ADDR(&dta->dst_addr, &dtb->dst_addr))
             return 0;
    +    else if (dta->proto != dtb->proto)
    +        return 0;
     
         /* Match. */
         return 1;
    @@ -1140,6 +1144,7 @@ DefragGetTracker(ThreadVars *tv, DecodeT
             DefragTrackerReset(tracker);
             tracker->af = lookup_key->af;
             tracker->id = lookup_key->id;
    +        tracker->proto = IP_GET_IPPROTO(p);
             tracker->src_addr = lookup_key->src_addr;
             tracker->dst_addr = lookup_key->dst_addr;
             tracker->policy = DefragGetOsPolicy(p);



Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Send a report that this bug log contains spam.