Heap-based Buffer Overflow in PcapPlusPlus TLS Hello Handler

Executive Summary

This vulnerability is a heap-based buffer overflow in the seladb PcapPlusPlus library, specifically in the function pcpp::SSLClientHelloMessage::getHandshakeVersion located in the TLS Hello Handler component. The issue occurs because the function accesses the handshakeVersion field of a TLS Client Hello packet without verifying if the packet data is complete and valid. This can cause the function to read beyond the allocated memory boundary when processing a truncated or malformed TLS Client Hello packet.

An attacker can exploit this vulnerability remotely by sending a specially crafted TLS Client Hello packet that triggers the buffer overflow. The attack is considered to have high complexity and is difficult to exploit, but the exploit has been publicly disclosed.

Useful 0 Not Useful 0

Impact Analysis

Exploiting this vulnerability can lead to a heap-based buffer overflow, which may allow an attacker to cause a denial of service (application crash) or potentially execute arbitrary code on the affected system.

Since the vulnerability can be triggered remotely without user interaction, it poses a risk to systems using the vulnerable PcapPlusPlus library version up to 25.05 that process TLS Client Hello packets.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for specially crafted TLS Client Hello packets that trigger a heap-buffer-overflow in the function pcpp::SSLClientHelloMessage::getHandshakeVersion(). Detection involves identifying malformed or truncated TLS Client Hello packets that cause out-of-bounds reads.

Using fuzz testing tools with AddressSanitizer can help identify this vulnerability by detecting heap-buffer-overflow errors when processing network traffic.

While no specific commands are provided, network administrators can use packet capture tools like tcpdump or Wireshark to capture TLS Client Hello packets and analyze them for abnormalities or truncation.

• Use tcpdump to capture TLS Client Hello packets: tcpdump -i <interface> 'tcp port 443 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' -w capture.pcap
• Analyze captured packets with Wireshark to inspect TLS Client Hello messages for truncation or malformed handshakeVersion fields.
• Run fuzz testing with AddressSanitizer enabled on the PcapPlusPlus library to detect heap-buffer-overflow issues.

Useful 0 Not Useful 0

Mitigation Strategies

The best immediate step to mitigate this vulnerability is to apply the patch identified as commit 98e671010bc7c87b95898c22ae289220ae92542b to the PcapPlusPlus library.

Since the vulnerability is exploitable remotely and involves processing malicious TLS Client Hello packets, it is also advisable to monitor and filter suspicious network traffic to reduce exposure.

Avoid using vulnerable versions of PcapPlusPlus (up to v25.05) until patched.

Useful 0 Not Useful 0

Compliance Impact

The provided context and resources do not contain any information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0