Package: wsdd2 Version: 1.8.7+dfsg-1.2 Severity: grave Tags: security upstream patch
wsdd2 has two remotely reachable memory-safety bugs, one in each packet parser. Both are present in 1.8.7 verbatim. 1. NULL-pointer write, remote DoS. wsd_parse_http_header() does *eol = '\0' on the result of strstr(buf, "\r\n") with no NULL check. A TCP segment to port 3702 beginning "POST " with no CRLF crashes the daemon. It is single-threaded, so one unauthenticated packet ends discovery for every host it advertises. Confirmed on hardware. 2. Out-of-bounds read. llmnr_send_response() walks the DNS question labels and reads QTYPE/QCLASS without bounding the cursor against the received length, so a crafted LLMNR query reads past the packet. Both found with libFuzzer under ASan/UBSan. Minimal fixes attached (wsdd2-01-http-null-deref.patch, wsdd2-02-llmnr-oob-read.patch). Note: upstream github.com/Netgear/wsdd2 and the fork the d/watch tracks (github.com/Andy2244/wsdd2) are both gone; github.com/oldium/wsdd2 is the only surviving tree and has these fixes. The package will need to carry them as debian/patches regardless.
wsdd2-01-http-null-deref.patch
Description: wsdd2-01-http-null-deref.patch
wsdd2-02-llmnr-oob-read.patch
Description: wsdd2-02-llmnr-oob-read.patch
