Browse code
Fix for CVE-2017-11542, CVE-2017-11543 and CVE-2017-11541
Change-Id: Ie4bcef32dd481e5a7ab0a12e20a4f2a83ad275ef
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/3717
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Anish Swaminathan <anishs@vmware.com>
DheerajSShetty authored on 2017/09/08 11:24:55Showing 2 changed files
| 1 | 1 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,73 @@ |
| 0 |
+diff -dupr a/print-pim.c b/print-pim.c |
|
| 1 |
+--- a/print-pim.c 2017-07-22 16:33:48.000000000 -0700 |
|
| 2 |
+@@ -306,6 +306,7 @@ pimv1_print(netdissect_options *ndo, |
|
| 3 |
+ pimv1_join_prune_print(ndo, &bp[8], len - 8); |
|
| 4 |
+ break; |
|
| 5 |
+ } |
|
| 6 |
++ ND_TCHECK(bp[4]); |
|
| 7 |
+ if ((bp[4] >> 4) != 1) |
|
| 8 |
+ ND_PRINT((ndo, " [v%d]", bp[4] >> 4)); |
|
| 9 |
+ return; |
|
| 10 |
+diff -dupr a/print-sl.c b/print-sl.c |
|
| 11 |
+--- a/print-sl.c 2017-07-22 16:33:48.000000000 -0700 |
|
| 12 |
+@@ -131,8 +131,21 @@ sliplink_print(netdissect_options *ndo, |
|
| 13 |
+ u_int hlen; |
|
| 14 |
+ |
|
| 15 |
+ dir = p[SLX_DIR]; |
|
| 16 |
+- ND_PRINT((ndo, dir == SLIPDIR_IN ? "I " : "O ")); |
|
| 17 |
+- |
|
| 18 |
++ switch (dir) {
|
|
| 19 |
++ |
|
| 20 |
++ case SLIPDIR_IN: |
|
| 21 |
++ ND_PRINT((ndo, "I ")); |
|
| 22 |
++ break; |
|
| 23 |
++ |
|
| 24 |
++ case SLIPDIR_OUT: |
|
| 25 |
++ ND_PRINT((ndo, "O ")); |
|
| 26 |
++ break; |
|
| 27 |
++ |
|
| 28 |
++ default: |
|
| 29 |
++ ND_PRINT((ndo, "Invalid direction %d ", dir)); |
|
| 30 |
++ dir = -1; |
|
| 31 |
++ break; |
|
| 32 |
++ } |
|
| 33 |
+ if (ndo->ndo_nflag) {
|
|
| 34 |
+ /* XXX just dump the header */ |
|
| 35 |
+ register int i; |
|
| 36 |
+@@ -155,13 +168,21 @@ sliplink_print(netdissect_options *ndo, |
|
| 37 |
+ * has restored the IP header copy to IPPROTO_TCP. |
|
| 38 |
+ */ |
|
| 39 |
+ lastconn = ((const struct ip *)&p[SLX_CHDR])->ip_p; |
|
| 40 |
++ ND_PRINT((ndo, "utcp %d: ", lastconn)); |
|
| 41 |
++ if (dir == -1) {
|
|
| 42 |
++ /* Direction is bogus, don't use it */ |
|
| 43 |
++ return; |
|
| 44 |
++ } |
|
| 45 |
+ hlen = IP_HL(ip); |
|
| 46 |
+ hlen += TH_OFF((const struct tcphdr *)&((const int *)ip)[hlen]); |
|
| 47 |
+ lastlen[dir][lastconn] = length - (hlen << 2); |
|
| 48 |
+- ND_PRINT((ndo, "utcp %d: ", lastconn)); |
|
| 49 |
+ break; |
|
| 50 |
+ |
|
| 51 |
+ default: |
|
| 52 |
++ if (dir == -1) {
|
|
| 53 |
++ /* Direction is bogus, don't use it */ |
|
| 54 |
++ return; |
|
| 55 |
++ } |
|
| 56 |
+ if (p[SLX_CHDR] & TYPE_COMPRESSED_TCP) {
|
|
| 57 |
+ compressed_sl_print(ndo, &p[SLX_CHDR], ip, |
|
| 58 |
+ length, dir); |
|
| 59 |
+diff -dupr a/util-print.c b/util-print.c |
|
| 60 |
+--- a/util-print.c 2017-07-22 16:33:49.000000000 -0700 |
|
| 61 |
+@@ -902,7 +902,7 @@ safeputs(netdissect_options *ndo, |
|
| 62 |
+ {
|
|
| 63 |
+ u_int idx = 0; |
|
| 64 |
+ |
|
| 65 |
+- while (*s && idx < maxlen) {
|
|
| 66 |
++ while (idx < maxlen && *s) {
|
|
| 67 |
+ safeputchar(ndo, *s); |
|
| 68 |
+ idx++; |
|
| 69 |
+ s++; |
| ... | ... |
@@ -1,7 +1,7 @@ |
| 1 | 1 |
Summary: Packet Analyzer |
| 2 | 2 |
Name: tcpdump |
| 3 | 3 |
Version: 4.9.1 |
| 4 |
-Release: 1%{?dist}
|
|
| 4 |
+Release: 2%{?dist}
|
|
| 5 | 5 |
License: BSD |
| 6 | 6 |
URL: http://www.tcpdump.org |
| 7 | 7 |
Source0: http://www.tcpdump.org/release/%{name}-%{version}.tar.gz
|
| ... | ... |
@@ -11,12 +11,14 @@ Vendor: VMware, Inc. |
| 11 | 11 |
Distribution: Photon |
| 12 | 12 |
BuildRequires: libpcap |
| 13 | 13 |
Requires: libpcap |
| 14 |
+Patch0: CVE-2017-11541-CVE-2017-11542-CVE-2017-11543.patch |
|
| 14 | 15 |
%description |
| 15 | 16 |
Tcpdump is a common packet analyzer that runs under the command line. |
| 16 | 17 |
It allows the user to display TCP/IP and other packets being |
| 17 | 18 |
transmitted or received over a network to which the computer is attached. |
| 18 | 19 |
%prep |
| 19 | 20 |
%setup -q |
| 21 |
+%patch0 -p1 |
|
| 20 | 22 |
%build |
| 21 | 23 |
./configure \ |
| 22 | 24 |
--prefix=%{_prefix}
|
| ... | ... |
@@ -32,6 +34,8 @@ make -k check |& tee %{_specdir}/%{name}-check-log || %{nocheck}
|
| 32 | 32 |
%{_sbindir}/*
|
| 33 | 33 |
%{_mandir}/man1/*
|
| 34 | 34 |
%changelog |
| 35 |
+* Thu Sep 07 2017 Dheeraj Shetty <dheerajs@vmware.com> 4.9.1-2 |
|
| 36 |
+- Fix for CVE-2017-11541 CVE-2017-11542 CVE-2017-11543 |
|
| 35 | 37 |
* Thu Aug 03 2017 Dheeraj Shetty <dheerajs@vmware.com> 4.9.1-1 |
| 36 | 38 |
- Updating version to 4.9.1 |
| 37 | 39 |
* Thu Feb 02 2017 Dheeraj Shetty <dheerajs@vmware.com> 4.9.0-1 |