Hello community, here is the log from the commit of package tcpdump for openSUSE:Factory checked in at 2020-11-10 13:39:05 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/tcpdump (Old) and /work/SRC/openSUSE:Factory/.tcpdump.new.11331 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "tcpdump" Tue Nov 10 13:39:05 2020 rev:42 rq:846281 version:4.9.3 Changes: -------- --- /work/SRC/openSUSE:Factory/tcpdump/tcpdump.changes 2020-01-06 16:02:11.925726139 +0100 +++ /work/SRC/openSUSE:Factory/.tcpdump.new.11331/tcpdump.changes 2020-11-10 13:40:00.592407161 +0100 @@ -1,0 +2,7 @@ +Thu Nov 5 10:58:11 UTC 2020 - Pedro Monreal <pmonr...@suse.com> + +- Security fix: [bsc#1178466, CVE-2020-8037] + * PPP decapsulator: Allocate the right buffer size +- Add tcpdump-CVE-2020-8037.patch + +------------------------------------------------------------------- @@ -15 +22 @@ -- Update to 4.9.3 +- Update to 4.9.3 [bsc#1153098] New: ---- tcpdump-CVE-2020-8037.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ tcpdump.spec ++++++ --- /var/tmp/diff_new_pack.ymb8Lq/_old 2020-11-10 13:40:01.384405587 +0100 +++ /var/tmp/diff_new_pack.ymb8Lq/_new 2020-11-10 13:40:01.388405579 +0100 @@ -1,7 +1,7 @@ # # spec file for package tcpdump # -# Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2020 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -29,6 +29,8 @@ Source3: https://www.tcpdump.org/tcpdump-workers.asc#/%{name}.keyring # PATCH-FIX-OPENSUSE tcpdump-CVE-2018-19519.patch - Initialize buf in print-hncp.c:print_prefix Patch0: tcpdump-CVE-2018-19519.patch +# PATCH-FIX-UPSTREAM bsc#1178466 CVE-2020-8037 PPP decapsulator: Allocate the right buffer size +Patch1: tcpdump-CVE-2020-8037.patch BuildRequires: libpcap-devel >= %{min_libpcap_version} BuildRequires: libsmi-devel BuildRequires: openssl-devel @@ -40,7 +42,7 @@ %prep %setup -q -%patch0 -p1 +%autopatch -p1 %build # guessing TSO needed in print-ip.c ++++++ tcpdump-CVE-2020-8037.patch ++++++ >From 32027e199368dad9508965aae8cd8de5b6ab5231 Mon Sep 17 00:00:00 2001 From: Guy Harris <g...@alum.mit.edu> Date: Sat, 18 Apr 2020 14:04:59 -0700 Subject: [PATCH] PPP: When un-escaping, don't allocate a too-large buffer. The buffer should be big enough to hold the captured data, but it doesn't need to be big enough to hold the entire on-the-network packet, if we haven't captured all of it. (backported from commit e4add0b010ed6f2180dcb05a13026242ed935334) --- print-ppp.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/print-ppp.c b/print-ppp.c index 891761728..33fb03412 100644 --- a/print-ppp.c +++ b/print-ppp.c @@ -1367,19 +1367,29 @@ print_bacp_config_options(netdissect_options *ndo, return 0; } +/* + * Un-escape RFC 1662 PPP in HDLC-like framing, with octet escapes. + * The length argument is the on-the-wire length, not the captured + * length; we can only un-escape the captured part. + */ static void ppp_hdlc(netdissect_options *ndo, const u_char *p, int length) { + u_int caplen = ndo->ndo_snapend - p; u_char *b, *t, c; const u_char *s; - int i, proto; + u_int i; + int proto; const void *se; + if (caplen == 0) + return; + if (length <= 0) return; - b = (u_char *)malloc(length); + b = (u_char *)malloc(caplen); if (b == NULL) return; @@ -1388,10 +1398,10 @@ ppp_hdlc(netdissect_options *ndo, * Do this so that we dont overwrite the original packet * contents. */ - for (s = p, t = b, i = length; i > 0 && ND_TTEST(*s); i--) { + for (s = p, t = b, i = caplen; i != 0; i--) { c = *s++; if (c == 0x7d) { - if (i <= 1 || !ND_TTEST(*s)) + if (i <= 1) break; i--; c = *s++ ^ 0x20;
