Re: Bearerbox Panic after receiving CIFS/SMB request at smsbox-port

Hi Alex,

No problem. It was quite trivial. But i ask because I don't see the same 
fix. Which file did you patch?

BR,
Nikos
----- Original Message ----- 
From: "Alexander Malysh" <[email protected]>
To: "Nikos Balkanas" <[email protected]>
Cc: <[email protected]>
Sent: Tuesday, September 22, 2009 10:30 AM
Subject: Re: Bearerbox Panic after receiving CIFS/SMB request at smsbox-port


> Hi Nikos,
>
> hmm I saw your patch after I commited my version. sorry...
>
> Thanks,
> Alexander Maysh
>
> Am 20.09.2009 um 21:58 schrieb Nikos Balkanas:
>
>> Hi Alex,
>>
>> Which one? I just sent a patch about the very same thing 10 hrs ago.
>>
>> BR,
>> Nikos
>> ----- Original Message ----- From: "Alexander Malysh" <[email protected]
>> >
>> To: "Michael Zervakis" <[email protected]>
>> Cc: <[email protected]>
>> Sent: Sunday, September 20, 2009 9:21 PM
>> Subject: Re: Bearerbox Panic after receiving CIFS/SMB request at 
>> smsbox-port
>>
>>
>>> Hi,
>>>
>>> thanks for report. I just fixed this issue in cvs. Please retest.
>>>
>>> Thanks,
>>> Alexander Malysh
>>>
>>> Am 18.09.2009 um 17:00 schrieb Michael Zervakis:
>>>
>>>> Dear all,
>>>>
>>>> During testing of Bearerbox using version cvs-20090506 I found  that 
>>>> if smsbox socket receives a CIFS/SMB request bearerbox  panics. This 
>>>> means that a malicious user could easily crash  bearerbox simply by 
>>>> scanning the host (for example via nmap -sV).
>>>>
>>>> 2009-09-18 17:09:18 [2002] [5] DEBUG: Started thread 30 (gw/ 
>>>> bb_boxc.c:function)
>>>> 2009-09-18 17:09:18 [2002] [30] PANIC: Internal error: unknown 
>>>> message type: -11317950
>>>> 2009-09-18 17:09:18 [2002] [30] PANIC: ./bearerbox(gw_panic+0xbc) 
>>>> [0x80d8fcc]
>>>> 2009-09-18 17:09:18 [2002] [30] PANIC: ./bearerbox(msg_unpack_real 
>>>> +0x78) [0x8065c88]
>>>> 2009-09-18 17:09:18 [2002] [30] PANIC: ./bearerbox [0x8057e50]
>>>> 2009-09-18 17:09:18 [2002] [30] PANIC: ./bearerbox [0x80596b9]
>>>> 2009-09-18 17:09:18 [2002] [30] PANIC: ./bearerbox [0x80cfafd]
>>>> 2009-09-18 17:09:18 [2002] [30] PANIC: /lib/libpthread.so.0 
>>>> [0xb7faa1b5]
>>>> 2009-09-18 17:09:18 [2002] [30] PANIC: /lib/libc.so.6(clone+0x5e) 
>>>> [0xb7abd3be]
>>>>
>>>>
>>>> addr2line -e /usr/gateway/sbin/bearerbox 0x80d8fcc 0x8065c88 
>>>> 0x8057e50 0x80596b9 0x80cfafd 0xb7faa1b5 0xb7abd3be
>>>> /usr/src/packages/SOURCES/gateway/gwlib/log.c:542
>>>> /usr/src/packages/SOURCES/gateway/gw/msg.c:245
>>>> /usr/src/packages/SOURCES/gateway/gw/bb_boxc.c:199
>>>> /usr/src/packages/SOURCES/gateway/gw/bb_boxc.c:656
>>>> /usr/src/packages/SOURCES/gateway/gwlib/gwthread-pthread.c:135
>>>> ??:0
>>>> ??:0
>>>>
>>>> Tcpdump
>>>> 17:09:18.100983 IP 10.12.0.50.29000 > 172.31.1.48.4201: S 
>>>> 3500919925:3500919925(0) ack 739634900 win 5840 <mss 1460,nop,
>>>> nop,sackOK>
>>>>      0x0000:  4500 0030 0000 4000 4006 e747 c129 e507  E.. 
>>>> 0..@[email protected].)..
>>>>      0x0010:  ac1f 0130 7148 1069 d0ab cc75 2c15 eed4  ... 
>>>> 0qH.i...u,...
>>>>      0x0020:  7012 16d0 df01 0000 0204 05b4 0101 0402 
>>>> p...............
>>>> 17:09:18.101524 IP 172.31.1.48.4201 > 10.12.0.50.29000: . ack 1  win 
>>>> 65535
>>>>      0x0000:  4500 0028 939b 4000 7e06 15b4 ac1f 0130  E.. 
>>>> (..@.~......0
>>>>      0x0010:  c129 e507 1069 7148 2c15 eed4 d0ab   cc76 
>>>> .)...iqH,......v
>>>>      0x0020:  5010 ffff 2296 0000 0000 0000 0000        P...".........
>>>> 17:09:18.114337 IP 172.31.1.48.4201 > 10.12.0.50.29000: P  1:169(168) 
>>>> ack 1 win 65535
>>>>      0x0000:  4500 00d0 939e 4000 7e06 1509 ac1f 0130 
>>>> E.....@.~......0
>>>>      0x0010:  c129 e507 1069 7148 2c15 eed4 d0ab   cc76 
>>>> .)...iqH,......v
>>>>      0x0020:  5018 ffff 82ac 0000 0000 00a4 ff53 4d42 
>>>> P............SMB
>>>>      0x0030:  7200 0000 0008 0140 0000 0000 0000 0000 
>>>> r......@........
>>>>      0x0040:  0000 0000 0000 4006 0000 0100 0081   0002 
>>>> ......@.........
>>>>      0x0050:  5043 204e 4554 574f 524b 2050 524f 4752 
>>>> PC.NETWORK.PROGR
>>>>      0x0060:  414d 2031 2e30 0002 4d49 4352 4f53 4f46  AM. 
>>>> 1.0..MICROSOF
>>>>      0x0070:  5420 4e45 5457 4f52 4b53 2031 2e30 3300  T.NETWORKS. 
>>>> 1.03.
>>>>      0x0080:  024d 4943 524f 534f 4654 204e 4554   574f 
>>>> .MICROSOFT.NETWO
>>>>      0x0090:  524b 5320 332e 3000 024c 414e 4d41 4e31  RKS. 
>>>> 3.0..LANMAN1
>>>>      0x00a0:  2e30 0002 4c4d 312e 3258 3030 3200 0253  . 
>>>> 0..LM1.2X002..S
>>>>      0x00b0:  616d 6261 0002 4e54 204c 414e 4d41 4e20 
>>>> amba..NT.LANMAN.
>>>>      0x00c0:  312e 3000 024e 5420 4c4d 2030 2e31 3200  1.0..NT.LM. 
>>>> 0.12.
>>>> 17:09:18.114348 IP 10.12.0.50.29000 > 172.31.1.48.4201: . ack 169   win 
>>>> 6432
>>>>      0x0000:  4500 0028 999f 4000 4006 4db0 c129 e507  E.. 
>>>> (..@[email protected]..)..
>>>>      0x0010:  ac1f 0130 7148 1069 d0ab cc76 2c15 ef7c  ... 
>>>> 0qH.i...v,..|
>>>>      0x0020:  5010 1920 08ce 0000                      P.......
>>>> 17:09:18.116709 IP 10.12.0.50.29000 > 172.31.1.48.4201: F 1:1(0)  ack 
>>>> 169 win 6432
>>>>      0x0000:  4500 0028 99a0 4000 4006 4daf c129 e507  E.. 
>>>> (..@[email protected]..)..
>>>>      0x0010:  ac1f 0130 7148 1069 d0ab cc76 2c15 ef7c  ... 
>>>> 0qH.i...v,..|
>>>>      0x0020:  5011 1920 08cd 0000                      P.......
>>>>
>>>> Sincerely,
>>>> Michael Zervakis
>>>>
>>>
>>
>