Page MenuHomeFreeBSD
Differential D12788

security/vuxml: add node.js remote DoS vulnerability announced 2017-10-24
ClosedPublic
Actions

Authored by bhughes on Oct 25 2017, 11:02 AM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, Apr 17, 2:02 AM
Unknown Object (File)
Mar 15 2025, 11:34 PM
Unknown Object (File)
Mar 14 2025, 4:33 AM
Unknown Object (File)
Mar 8 2025, 9:55 AM
Unknown Object (File)
Mar 7 2025, 11:40 PM
Unknown Object (File)
Mar 6 2025, 5:30 PM
Unknown Object (File)
Mar 4 2025, 7:15 PM
Unknown Object (File)
Feb 28 2025, 8:32 AM
View All 50 Files
Subscribers
swills

Details

Reviewers
robak
mat
swills
Commits
rP452934: security/vuxml: add node.js remote DoS vulnerability announced 2017-10-24
Summary

security/vuxml: add node.js remote DoS vulnerability announced 2017-10-24

Approved by: robak (mentor)
Security: d7d1cc94-b971-11e7-af3a-f1035dd0da62

Test Plan

$ make validate
/bin/sh /usr/ports/security/vuxml/files/tidy.sh "/usr/ports/security/vuxml/files/tidy.xsl" "/usr/ports/security/vuxml/vuln.xml" > "/usr/ports/security/vuxml/vuln.xml.tidy"

Validating...

/usr/local/bin/xmllint --valid --noout /usr/ports/security/vuxml/vuln.xml

Successful.

Checking if tidy differs...
... seems okay
Checking for space/tab...
... seems okay
/usr/local/bin/python2.7 /usr/ports/security/vuxml/files/extra-validation.py /usr/ports/security/vuxml/vuln.xml

Diff Detail

Repository
rP FreeBSD ports repository
Lint
No Lint Coverage
Unit
No Test Coverage
Build Status
Buildable 12244
Build 12535: arc lint + arc unit

Event Timeline

bhughes created this revision.Oct 25 2017, 11:02 AM
Harbormaster completed remote builds in B12223: Diff 34322.Oct 25 2017, 11:02 AM
bhughes updated this revision to Diff 34341.Oct 25 2017, 6:49 PM

Updated after recent vuxml.xml changes

Harbormaster completed remote builds in B12233: Diff 34341.Oct 25 2017, 6:49 PM
swills added a subscriber: swills.Oct 26 2017, 5:40 PM

This line:

<blockquote cite="INSERT URL HERE">

needs to be updated.

bhughes updated this revision to Diff 34364.Oct 26 2017, 5:58 PM

Fill in the blockquote cite URL

swills accepted this revision.Oct 26 2017, 5:58 PM

LGTM

This revision is now accepted and ready to land.Oct 26 2017, 5:58 PM
bhughes edited the summary of this revision. (Show Details)Oct 26 2017, 6:08 PM
Closed by commit rP452934: security/vuxml: add node.js remote DoS vulnerability announced 2017-10-24 (authored by bhughes). · Explain WhyOct 27 2017, 3:54 PM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathSize
security/
vuxml/
34 lines

Diff 34364

View Options

security/vuxml/vuln.xml

  • This file was added.
#include <atf-c.h>
#include <alias.h>
#include <stdio.h>
#include <stdlib.h>
#include "util.h"
ATF_TC_WITHOUT_HEAD(1_portforward);
ATF_TC_BODY(1_portforward, dummy)
{
struct libalias *la = LibAliasInit(NULL);
struct alias_link *pf1, *pf2, *pf3, *pf4;
struct ip *p;
struct udphdr *u;
ATF_REQUIRE(la != NULL);
LibAliasSetAddress(la, masq);
LibAliasSetMode(la, PKT_ALIAS_RESET_ON_ADDR_CHANGE, ~0);
LibAliasSetMode(la, PKT_ALIAS_DENY_INCOMING, PKT_ALIAS_DENY_INCOMING);
/*
* Fully specified
*/
pf1 = LibAliasRedirectPort(la, prv1, ntohs(0x1234), ext, ntohs(0x5678), masq, ntohs(0xabcd), IPPROTO_UDP);
ATF_REQUIRE(pf1 != NULL);
p = ip_packet(0, 64);
UDP_UNNAT_CHECK(p, u, ext, 0x5678, masq, 0xabcd, prv1, 0x1234);
/* try again */
UDP_UNNAT_CHECK(p, u, ext, 0x5678, masq, 0xabcd, prv1, 0x1234);
/* different source */
UDP_UNNAT_FAIL(p, u, pub, 0x5678, masq, 0xabcd);
UDP_UNNAT_FAIL(p, u, ext, 0xdead, masq, 0xabcd);
/* clear table by keeping the address */
LibAliasSetAddress(la, ext);
LibAliasSetAddress(la, masq);
/* delete and try again */
LibAliasRedirectDelete(la, pf1);
UDP_UNNAT_FAIL(p, u, ext, 0x5678, masq, 0xabcd);
/*
* Any external port
*/
pf2 = LibAliasRedirectPort(la, prv2, ntohs(0x1234), ext, ntohs(0), masq, ntohs(0xabcd), IPPROTO_UDP);
ATF_REQUIRE(pf2 != NULL);
u = set_udp(p, 0x5678, 0xabcd);
UNNAT_CHECK(p, ext, masq, prv2);
ATF_CHECK(u->uh_sport == ntohs(0x5678));
ATF_CHECK(u->uh_dport == ntohs(0x1234));
/* try again */
u = set_udp(p, 0x5678, 0xabcd);
UNNAT_CHECK(p, ext, masq, prv2);
ATF_CHECK(u->uh_sport == ntohs(0x5678));
ATF_CHECK(u->uh_dport == ntohs(0x1234));
/* different source */
u = set_udp(p, 0x5678, 0xabcd);
UNNAT_FAIL(p, pub, masq);
u = set_udp(p, 0xdead, 0xabcd);
UNNAT_CHECK(p, ext, masq, prv2);
ATF_CHECK(u->uh_sport == ntohs(0xdead));
ATF_CHECK(u->uh_dport == ntohs(0x1234));
/* clear table by keeping the address */
LibAliasSetAddress(la, ext);
LibAliasSetAddress(la, masq);
LibAliasRedirectDelete(la, pf2);
/* try again, but not the existing flow */
u = set_udp(p, 0x5678, 0xabcd);
UNNAT_FAIL(p, ext, masq);
/*
* Any external host
*/
pf3 = LibAliasRedirectPort(la, prv3, ntohs(0x1234), ANY_ADDR, ntohs(0x5678), masq, ntohs(0xabcd), IPPROTO_UDP);
ATF_REQUIRE(pf3 != NULL);
u = set_udp(p, 0x5678, 0xabcd);
UNNAT_CHECK(p, ext, masq, prv3);
ATF_CHECK(u->uh_sport == ntohs(0x5678));
ATF_CHECK(u->uh_dport == ntohs(0x1234));
/* try again */
u = set_udp(p, 0x5678, 0xabcd);
UNNAT_CHECK(p, ext, masq, prv3);
ATF_CHECK(u->uh_sport == ntohs(0x5678));
ATF_CHECK(u->uh_dport == ntohs(0x1234));
/* different source */
u = set_udp(p, 0x5678, 0xabcd);
UNNAT_CHECK(p, pub, masq, prv3);
ATF_CHECK(u->uh_sport == ntohs(0x5678));
ATF_CHECK(u->uh_dport == ntohs(0x1234));
u = set_udp(p, 0xdead, 0xabcd);
UNNAT_FAIL(p, ext, masq);
/* clear table by keeping the address */
LibAliasSetAddress(la, ext);
LibAliasSetAddress(la, masq);
LibAliasRedirectDelete(la, pf3);
/* try again, but not the existing flow */
u = set_udp(p, 0x5678, 0xabcd);
UNNAT_FAIL(p, ext, masq);
/*
* Any external host, any port
*/
pf4 = LibAliasRedirectPort(la, cgn, ntohs(0x1234), ANY_ADDR, ntohs(0), masq, ntohs(0xabcd), IPPROTO_UDP);
ATF_REQUIRE(pf4 != NULL);
u = set_udp(p, 0x5678, 0xabcd);
UNNAT_CHECK(p, ext, masq, cgn);
ATF_CHECK(u->uh_sport == ntohs(0x5678));
ATF_CHECK(u->uh_dport == ntohs(0x1234));
/* try again */
u = set_udp(p, 0x5678, 0xabcd);
UNNAT_CHECK(p, ext, masq, cgn);
ATF_CHECK(u->uh_sport == ntohs(0x5678));
ATF_CHECK(u->uh_dport == ntohs(0x1234));
/* different source */
u = set_udp(p, 0x5678, 0xabcd);
UNNAT_CHECK(p, pub, masq, cgn);
ATF_CHECK(u->uh_sport == ntohs(0x5678));
ATF_CHECK(u->uh_dport == ntohs(0x1234));
u = set_udp(p, 0xdead, 0xabcd);
UNNAT_CHECK(p, ext, masq, cgn);
ATF_CHECK(u->uh_sport == ntohs(0xdead));
ATF_CHECK(u->uh_dport == ntohs(0x1234));
/* clear table by keeping the address */
LibAliasSetAddress(la, ext);
LibAliasSetAddress(la, masq);
LibAliasRedirectDelete(la, pf4);
/* try again, but not the existing flow */
u = set_udp(p, 0x5678, 0xabcd);
UNNAT_FAIL(p, ext, masq);
free(p);
LibAliasUninit(la);
}
ATF_TC_WITHOUT_HEAD(2_portoverlap);
ATF_TC_BODY(2_portoverlap, dummy)
{
struct libalias *la = LibAliasInit(NULL);
struct alias_link *pf1, *pf2, *pf3, *pf4;
struct ip *p;
struct udphdr *u;
ATF_REQUIRE(la != NULL);
LibAliasSetAddress(la, masq);
LibAliasSetMode(la, PKT_ALIAS_RESET_ON_ADDR_CHANGE, ~0);
LibAliasSetMode(la, PKT_ALIAS_DENY_INCOMING, PKT_ALIAS_DENY_INCOMING);
/*
* Fully specified
*/
pf1 = LibAliasRedirectPort(la, prv2, ntohs(0x1234), ext, ntohs(0x5678), masq, ntohs(0xabcd), IPPROTO_UDP);
ATF_REQUIRE(pf1 != NULL);
p = ip_packet(0, 64);
UDP_UNNAT_CHECK(p, u, ext, 0x5678, masq, 0xabcd, prv2, 0x1234);
/* clear table by keeping the address */
LibAliasSetAddress(la, ext);
LibAliasSetAddress(la, masq);
/*
* Fully specified (override)
*/
pf1 = LibAliasRedirectPort(la, prv1, ntohs(0x1234), ext, ntohs(0x5678), masq, ntohs(0xabcd), IPPROTO_UDP);
ATF_REQUIRE(pf1 != NULL);
UDP_UNNAT_CHECK(p, u, ext, 0x5678, masq, 0xabcd, prv1, 0x1234);
/* clear table by keeping the address */
LibAliasSetAddress(la, ext);
LibAliasSetAddress(la, masq);
/*
* Any external port
*/
pf2 = LibAliasRedirectPort(la, prv2, ntohs(0x1234), ext, ntohs(0), masq, ntohs(0xabcd), IPPROTO_UDP);
ATF_REQUIRE(pf2 != NULL);
UDP_UNNAT_CHECK(p, u, ext, 0x5679, masq, 0xabcd, prv2, 0x1234);
/* more specific rule wins */
UDP_UNNAT_CHECK(p, u, ext, 0x5678, masq, 0xabcd, prv1, 0x1234);
/* clear table by keeping the address */
LibAliasSetAddress(la, ext);
LibAliasSetAddress(la, masq);
/*
* Any external host
*/
pf3 = LibAliasRedirectPort(la, prv3, ntohs(0x1234), ANY_ADDR, ntohs(0x5678), masq, ntohs(0xabcd), IPPROTO_UDP);
ATF_REQUIRE(pf3 != NULL);
UDP_UNNAT_CHECK(p, u, pub, 0x5678, masq, 0xabcd, prv3, 0x1234);
/* more specific rule wins */
UDP_UNNAT_CHECK(p, u, ext, 0x5679, masq, 0xabcd, prv2, 0x1234);
UDP_UNNAT_CHECK(p, u, ext, 0x5678, masq, 0xabcd, prv1, 0x1234);
/* clear table by keeping the address */
LibAliasSetAddress(la, ext);
LibAliasSetAddress(la, masq);
/*
* Any external host, any port
*/
pf4 = LibAliasRedirectPort(la, cgn, ntohs(0x1234), ANY_ADDR, ntohs(0), masq, ntohs(0xabcd), IPPROTO_UDP);
ATF_REQUIRE(pf4 != NULL);
UDP_UNNAT_CHECK(p, u, prv1, 0x5679, masq, 0xabcd, cgn, 0x1234);
/* more specific rule wins */
UDP_UNNAT_CHECK(p, u, pub, 0x5678, masq, 0xabcd, prv3, 0x1234);
UDP_UNNAT_CHECK(p, u, ext, 0x5679, masq, 0xabcd, prv2, 0x1234);
UDP_UNNAT_CHECK(p, u, ext, 0x5678, masq, 0xabcd, prv1, 0x1234);
free(p);
LibAliasUninit(la);
}
ATF_TP_ADD_TCS(natin)
{
/* Use "dd if=/dev/random bs=2 count=1 | od -x" to reproduce */
srand(0xe859);
ATF_TP_ADD_TC(natin, 1_portforward);
ATF_TP_ADD_TC(natin, 2_portoverlap);
return atf_no_error();
}