Bug 370839 – <net-analyzer/sflowtool-3.20: Buffer overflow vulnerability in sflowtool.c:getData32()

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Jeroen Roovers (RETIRED) 2011-06-09 17:05:51 UTC]

Quoting the ChangeLog from net-analyzer/sflowtool-3.20:

April-8-2010
       3.15 - add host-sflow structure decodes
            - add more wifi-sflow structure decodes
            - fix bug/overrun vulnerability in getData32 - thanks to Sven Eshenberg

Seems to be this code:

@@ -1361,14 +1365,23 @@
   -----------------___________________________------------------
 */
 
+static u_int32_t getData32_nobswap(SFSample *sample) {
+  u_int32_t ans = *(sample->datap)++;
+  // make sure we didn't run off the end of the datagram.  Thanks to 
+  // Sven Eschenberg for spotting a bug/overrun-vulnerabilty that was here before.
+  if((u_char *)sample->datap > sample->endp) SFABORT(sample, SF_ABORT_EOS);
+  return ans;
+}
+
 static u_int32_t getData32(SFSample *sample) {
-  if((u_char *)sample->datap >= sample->endp) SFABORT(sample, SF_ABORT_EOS);
-  return ntohl(*(sample->datap)++);
+  return ntohl(getData32_nobswap(sample));
 }
 
-static u_int32_t getData32_nobswap(SFSample *sample) {
-  if((u_char *)sample->datap >= sample->endp) SFABORT(sample, SF_ABORT_EOS);
-  return *(sample->datap)++;
+static float getFloat(SFSample *sample) {
+  float fl;
+  u_int32_t reg = getData32(sample);
+  memcpy(&fl, &reg, 4);
+  return fl;
 }

Needless, to say, this is fixed in 3.20, which is in the tree.

[Comment 1 Tim Sammut (RETIRED) 2011-06-12 18:37:38 UTC]

Thanks for the bug, Jeroen.

Arches, please test and mark stable:
=net-analyzer/sflowtool-3.20
Target keywords : "ppc x86"

[Comment 2 Paweł Hajdan, Jr. (RETIRED) 2011-06-13 10:12:23 UTC]

x86 stable

[Comment 3 Brent Baude (RETIRED) 2011-06-22 20:23:43 UTC]

ppc done; closing as last arch

[Comment 4 Jeroen Roovers (RETIRED) 2011-06-23 19:33:58 UTC]

(In reply to comment #3)
> ppc done; closing as last arch

"Note: Please do not mark this bug as resolved after bumping or stabilizing. The Security Team will take care of that. Thanks."

[Comment 5 Tim Sammut (RETIRED) 2011-06-26 21:28:30 UTC]

Thanks, folks. ;)

GLSA request filed.

[Comment 6 Sergey Popov 2012-10-17 16:43:57 UTC]

Current stable version in tree is 3.27, as it's unaffected, maybe this bug should be closed?

[Comment 7 Jeroen Roovers (RETIRED) 2012-10-17 16:48:09 UTC]

(In reply to comment #6)
> Current stable version in tree is 3.27, as it's unaffected, maybe this bug
> should be closed?

security@ has its ways.

[Comment 8 GLSAMaker/CVETool Bot 2014-12-12 00:38:11 UTC]

This issue was resolved and addressed in
 GLSA 201412-09 at http://security.gentoo.org/glsa/glsa-201412-09.xml
by GLSA coordinator Sean Amoss (ackle).