tcpdump multiple CVEs

[Gianfranco Costamagna]

disclaimer for the version bump: Debian did the same, so I presume their security team had good reasons to do it

[14:39:59] <LocutusOfBorg> reverse-depends... tcpdump is a tool, not a library
[14:40:17] <LocutusOfBorg> I reverse-depends can use it by calling the binary, and the commandline didn't change
[14:40:23] <LocutusOfBorg> so, I presume everything is fine
[14:40:38] <LocutusOfBorg> wrt apparmor, you are right
[14:41:52] <LocutusOfBorg> btw I'm using tcpdump on xenial right now, it works as usual

[Tyler Hicks (tyhicks)]

Thanks for the debdiffs! I'll need a little more info before I seriously begin sponsoring them. Note that since tcpdump is in main, I'll still need to do my own QA.

What investigation did you perform to feel comfortable in disabling the tests that were disabled?

What amount of testing did you perform? In which Ubuntu releases and in what environment (whether or not in a VM, the CPU architecture, etc.)?

[Gianfranco Costamagna (costamagnagianfranco)]

hi Tyler, sorry for the long delay!

>Thanks for the debdiffs! I'll need a little more info before I seriously begin sponsoring them. Note >that since tcpdump is in main, I'll still need to do my own QA.

sure, no problem (BTW I can upload in main too FWIW)

>What investigation did you perform to feel comfortable in disabling the tests that were disabled?

short story:
the tests are *new* tests, and they need a new pcap to perform correctly (yes, the old pcap will fail and make tcpdump crash in such corner cases, this is the current status quo, and unless you want me to update libpcap won't change)

the investigation is: Debian disabled the same tests to the same security uploads, against the same pcap versions (and I confirmed the tests were failing in Ubuntu too)

long story:
these new tests are e.g. catching some issues with *broken* pcap files, they were discovered after pcap was released, and "fixed" in new pcap versions.
Of course they aren't faults in tcpdump, but tcpdump people like to catch them :)

Debian usually when a test requires a new libpcap to succeed just bumps the bounds of the required pcap version, and lives happy. In this case we need to revert such bump and avoid such tests.

They aren't regressions, probably you can just grab the pcap file from the source code, try to run against them and you will see the same failures.

>What amount of testing did you perform? In which Ubuntu releases and in what environment (whether or >not in a VM, the CPU architecture, etc.)?

everything is amd64, I did test them on Xenial (my primary system), and tcpdumped my network interface for some time (I can see the packets correctly).
I setup a Trusty VM and a Yakkety one to test the same things.
Everything has been working correctly.

"sudo tcpdump -i interface" is my test.

[Marc Deslauriers (mdeslaur)]

Thanks for the comments. Ack on the debdiffs, I've built them with a couple of minor nitpicks and will be releasing them today. Thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package tcpdump - 4.9.0-1ubuntu1~ubuntu12.04.1

---------------
tcpdump (4.9.0-1ubuntu1~ubuntu12.04.1) precise-security; urgency=medium

  [ Gianfranco Costamagna ]
  * Backport to precise to fix CVEs (LP: #1662177).
  * Reset libpcap dependency to precise version
  * Enable crypto support, dropped in zesty because of openssl.
  * Disable some tests failing with older pcap versions

tcpdump (4.9.0-1ubuntu1) zesty; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - debian/{control, README.Debian, tcpdump.dirs, usr.sbin.tcpdump,
      install, rules, patches/patches/90_man_apparmor.diff}:
      + Add AppArmor profile.
    - debian/usr.sbin.tcpdump:
      + Allow capability net_admin to support '-j'.

tcpdump (4.9.0-1) unstable; urgency=high

  * New upstream security release, fixing the following:
    + CVE-2016-7922: buffer overflow in print-ah.c:ah_print().
    + CVE-2016-7923: buffer overflow in print-arp.c:arp_print().
    + CVE-2016-7924: buffer overflow in print-atm.c:oam_print().
    + CVE-2016-7925: buffer overflow in print-sl.c:sl_if_print().
    + CVE-2016-7926: buffer overflow in print-ether.c:ethertype_print().
    + CVE-2016-7927: buffer overflow in print-802_11.c:ieee802_11_radio_print().
    + CVE-2016-7928: buffer overflow in print-ipcomp.c:ipcomp_print().
    + CVE-2016-7929: buffer overflow in print-juniper.c:juniper_parse_header().
    + CVE-2016-7930: buffer overflow in print-llc.c:llc_print().
    + CVE-2016-7931: buffer overflow in print-mpls.c:mpls_print().
    + CVE-2016-7932: buffer overflow in print-pim.c:pimv2_check_checksum().
    + CVE-2016-7933: buffer overflow in print-ppp.c:ppp_hdlc_if_print().
    + CVE-2016-7934: buffer overflow in print-udp.c:rtcp_print().
    + CVE-2016-7935: buffer overflow in print-udp.c:rtp_print().
    + CVE-2016-7936: buffer overflow in print-udp.c:udp_print().
    + CVE-2016-7937: buffer overflow in print-udp.c:vat_print().
    + CVE-2016-7938: integer overflow in print-zeromq.c:zmtp1_print_frame().
    + CVE-2016-7939: buffer overflow in print-gre.c, multiple functions.
    + CVE-2016-7940: buffer overflow in print-stp.c, multiple functions.
    + CVE-2016-7973: buffer overflow in print-atalk.c, multiple functions.
    + CVE-2016-7974: buffer overflow in print-ip.c, multiple functions.
    + CVE-2016-7975: buffer overflow in print-tcp.c:tcp_print().
    + CVE-2016-7983: buffer overflow in print-bootp.c:bootp_print().
    + CVE-2016-7984: buffer overflow in print-tftp.c:tftp_print().
    + CVE-2016-7985: buffer overflow in print-calm-fast.c:calm_fast_print().
    + CVE-2016-7986: buffer overflow in print-geonet.c, multiple functions.
    + CVE-2016-7992: buffer overflow in print-cip.c:cip_if_print().
    + CVE-2016-7993: a bug in util-print.c:relts_print() could cause a
      buffer overflow in multiple protocol parsers (DNS, DVMRP, HSRP, IGMP,
      lightweight resolver protocol, PIM).
    + CVE-2016-8574: buffer overflow in print-fr.c:frf15_print().
    + CVE-2016-8575: buffer overflow in print-fr.c:q933_print().
    + CVE-2017-5202: buffer overflow in print-isoclns.c:clnp_print().
    + CVE-2017-5203: buffer overflow in print-bootp.c:boot...

[Launchpad Janitor (janitor)]

This bug was fixed in the package tcpdump - 4.9.0-1ubuntu1~ubuntu16.10.1

---------------
tcpdump (4.9.0-1ubuntu1~ubuntu16.10.1) yakkety-security; urgency=medium

  * Backport to yakkety to fix CVEs (LP: #1662177).
  * Reset libpcap dependency to yakkety version
  * Enable crypto support, dropped in zesty because of openssl.
  * Disable some tests failing with older pcap versions

tcpdump (4.9.0-1ubuntu1) zesty; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - debian/{control, README.Debian, tcpdump.dirs, usr.sbin.tcpdump,
      install, rules, patches/patches/90_man_apparmor.diff}:
      + Add AppArmor profile.
    - debian/usr.sbin.tcpdump:
      + Allow capability net_admin to support '-j'.

tcpdump (4.9.0-1) unstable; urgency=high

  * New upstream security release, fixing the following:
    + CVE-2016-7922: buffer overflow in print-ah.c:ah_print().
    + CVE-2016-7923: buffer overflow in print-arp.c:arp_print().
    + CVE-2016-7924: buffer overflow in print-atm.c:oam_print().
    + CVE-2016-7925: buffer overflow in print-sl.c:sl_if_print().
    + CVE-2016-7926: buffer overflow in print-ether.c:ethertype_print().
    + CVE-2016-7927: buffer overflow in print-802_11.c:ieee802_11_radio_print().
    + CVE-2016-7928: buffer overflow in print-ipcomp.c:ipcomp_print().
    + CVE-2016-7929: buffer overflow in print-juniper.c:juniper_parse_header().
    + CVE-2016-7930: buffer overflow in print-llc.c:llc_print().
    + CVE-2016-7931: buffer overflow in print-mpls.c:mpls_print().
    + CVE-2016-7932: buffer overflow in print-pim.c:pimv2_check_checksum().
    + CVE-2016-7933: buffer overflow in print-ppp.c:ppp_hdlc_if_print().
    + CVE-2016-7934: buffer overflow in print-udp.c:rtcp_print().
    + CVE-2016-7935: buffer overflow in print-udp.c:rtp_print().
    + CVE-2016-7936: buffer overflow in print-udp.c:udp_print().
    + CVE-2016-7937: buffer overflow in print-udp.c:vat_print().
    + CVE-2016-7938: integer overflow in print-zeromq.c:zmtp1_print_frame().
    + CVE-2016-7939: buffer overflow in print-gre.c, multiple functions.
    + CVE-2016-7940: buffer overflow in print-stp.c, multiple functions.
    + CVE-2016-7973: buffer overflow in print-atalk.c, multiple functions.
    + CVE-2016-7974: buffer overflow in print-ip.c, multiple functions.
    + CVE-2016-7975: buffer overflow in print-tcp.c:tcp_print().
    + CVE-2016-7983: buffer overflow in print-bootp.c:bootp_print().
    + CVE-2016-7984: buffer overflow in print-tftp.c:tftp_print().
    + CVE-2016-7985: buffer overflow in print-calm-fast.c:calm_fast_print().
    + CVE-2016-7986: buffer overflow in print-geonet.c, multiple functions.
    + CVE-2016-7992: buffer overflow in print-cip.c:cip_if_print().
    + CVE-2016-7993: a bug in util-print.c:relts_print() could cause a
      buffer overflow in multiple protocol parsers (DNS, DVMRP, HSRP, IGMP,
      lightweight resolver protocol, PIM).
    + CVE-2016-8574: buffer overflow in print-fr.c:frf15_print().
    + CVE-2016-8575: buffer overflow in print-fr.c:q933_print().
    + CVE-2017-5202: buffer overflow in print-isoclns.c:clnp_print().
    + CVE-2017-5203: buffer overflow in print-bootp.c:bootp_print().
    + CVE-2017-52...