Segmentation fault on tcpick with fragmented IP packets

[Gerard Wagener]

While parsing TCP packets generated by fragrouter (package fragrouter), (i.e F7 attack), tcpick does a segmentation fault. An attacker can thus evade from network forensics.

Candidate: 0.2.1-4ubuntu1
Hardy

[Kees Cook (kees)]

Thank you for using Ubuntu and taking the time to report a bug. Can you provide a specific reproducer for this problem? Also, please enable[1] Apport, and you can file a report from the crash itself.

[1] https://wiki.ubuntu.com/Apport#How%20to%20enable%20apport

[Gerard Wagener (haegardev)]

Here is a pcap file that crashes tcpick even in intrepid (I changed Ubuntu in the mean time)

gwagen@gwagenlt:~/pcap-tests$ tcpick -wR -r F7-eth1.cap
Starting tcpick 0.2.1 at 2009-03-27 19:24 CET
Timeout for connections is 600
tcpick: reading from F7-eth1.cap
1 SYN-SENT 10.0.0.2:10361 > 10.0.1.2:0
2 SYN-SENT 10.0.0.2:0 > 10.0.1.2:0
3 SYN-SENT 10.0.0.2:0 > 10.0.1.2:0
4 SYN-SENT 10.0.0.2:56956 > 10.0.1.2:sieve
5 SYN-SENT 10.0.0.2:0 > 10.0.1.2:0
6 SYN-SENT 10.0.0.2:10061 > 10.0.1.2:0
7 SYN-SENT 10.0.0.2:0 > 10.0.1.2:0
4 SYN-RECEIVED 10.0.0.2:56956 > 10.0.1.2:sieve
Segmentation fault

[Jamie Strandboge (jdstrand)]

Supplied reproducer crashes tcpick on Jaunty.

[Jamie Strandboge (jdstrand)]

Forwarded bug to upstream at <email address hidden>.

[shapirus (me-ngeefk4xayt3t4u)]

After having been unable to use tcpick for a few years now because of this bug, I am happy to share that it seems to be gone in the latest Xenial package. I rebuilt the source package taken from Xenial under Trusty, and it no longer crashes.

However, I haven't tried to test it with the provided pcap file. It has always crashed on me anytime right after receiving first packets, and now it doesn't. I am pretty sure it was all the same bug.