Bug 408183 – <net-misc/iputils-20121221: integer overflow found in iputils/ping_common.c main_loop()

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Michael Harrison 2012-03-14 17:55:07 UTC]

An integer overflow was found in iputils/ping_common.c main_loop() function
which could lead to excessive CPU usage when triggered (could lead to DoS). This
means that both ping and ping6 are vulnerable.

Affected versions:

Tested on Fedora/Debian/Gentoo Linux system (2.6.x x86_32 and x86_64) on iputils
version 20101006. ping6 seems also to be affected since it's relying on same
ping_common.c functions.

Since iputils is not maintained any longer
(http://www.spinics.net/lists/netdev/msg191346.html), patch must be applied from
source.

Proposed Patch:
Quick'n dirty patch (full patch in appendix) is to cast test result as long long:
{{{
    593                  if (((long long)1000*next) <= (long long)1000000/(int)HZ) {
}}}

per:
* Christophe Alladoum (HSC)
* Romain Coltel (HSC)

[Comment 1 SpanKY 2013-01-25 05:26:32 UTC]

upstream fixed this in 70e20add49fad5e99b8727cd69addf2d91fa64f6

it's included in iputils-20121221 which is now in the tree

[Comment 2 Sean Amoss (RETIRED) 2013-01-27 15:24:53 UTC]

(In reply to comment #1)
> upstream fixed this in 70e20add49fad5e99b8727cd69addf2d91fa64f6
> 
> it's included in iputils-20121221 which is now in the tree

Thank you. 

Arches, please test and mark stable.

[Comment 3 Jeroen Roovers (RETIRED) 2013-01-28 03:23:55 UTC]

Arch teams, please test and mark stable:
=net-misc/iputils-20121221
Stable KEYWORDS : alpha amd64 arm hppa ia64 m68k ppc ppc64 s390 sh sparc x86

[Comment 4 Sergey Popov 2013-01-28 11:24:27 UTC]

amd64 stable

[Comment 5 Sergey Popov 2013-01-28 13:50:47 UTC]

arm stable

[Comment 6 Jeroen Roovers (RETIRED) 2013-01-28 19:50:37 UTC]

Stable for HPPA.

[Comment 7 Agostino Sarubbo 2013-01-29 11:28:47 UTC]

ia64 stable

[Comment 8 Agostino Sarubbo 2013-01-30 18:23:45 UTC]

x86 stable

[Comment 9 Agostino Sarubbo 2013-01-31 23:00:32 UTC]

ppc64 stable

[Comment 10 Agostino Sarubbo 2013-01-31 23:10:29 UTC]

ppc stable

[Comment 11 Agostino Sarubbo 2013-02-06 19:50:05 UTC]

sparc stable

[Comment 12 Agostino Sarubbo 2013-02-08 12:07:52 UTC]

sh stable

[Comment 13 Agostino Sarubbo 2013-02-08 14:48:53 UTC]

s390 stable

[Comment 14 Agostino Sarubbo 2013-02-08 16:47:09 UTC]

alpha stable

[Comment 15 Tobias Heinlein (RETIRED) 2013-03-24 19:58:38 UTC]

Added to existing draft.

[Comment 16 Chris Reffett (RETIRED) 2013-09-22 14:03:25 UTC]

m68k -> ~ only, removing from CC. @maintainers: cleanup please.

[Comment 17 Yury German 2014-05-30 22:41:58 UTC]

Maintainer(s), please drop the vulnerable version so we can proceed with closing this bug cleanup has been around since 2013-09-22

[Comment 18 Chris Reffett (RETIRED) 2014-08-25 22:50:31 UTC]

Maintainer timeout, cleanup done.

[Comment 19 Aaron Bauman (RETIRED) 2016-03-02 10:37:18 UTC]

No GLSA draft or request exists for this as previously mentioned.  Unable to locate a previously released GLSA regarding this vulnerability.

[Comment 20 Aaron Bauman (RETIRED) 2016-03-02 10:39:57 UTC]

GLSA Request: d4c1202de

[Comment 21 Aaron Bauman (RETIRED) 2016-03-07 09:10:14 UTC]

Vulnerable versions purged from tree almost 2 years ago.  No CVE was released due to upstream not maintaining this package anymore.