Hello, welcome to the Tuesday, May 11, 2021 edition of the Sandsenet Storm Center's Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

I wrote a quick post today about some of these recent vulnerabilities in IP address validation libraries. In particular, the problem

or the root cause of these vulnerabilities was how addresses that are expressed in Octal are

being parsed by these libraries. And for the most part, well, these libraries didn't really take Actal into account that then

led to problems how the IP addresses were validated. This would not really be that big of a

problem if the library that then actually does the network connection did use a similar

interpretation of these IP addresses. But pretty much any software

that connects to a network service or implements a network service does use the Basic C-Sockets

library, and yes, that library does parse Octal IP addresses. Now, this library also provides

a function, INET A2N, that does convert IP addresses expressed as a string into an integer. And that's

probably a safer function to use because it's part of the same library.

It does interpret IP addresses the same way as the functions that actually establish the connections.

Instead, many of these vulnerable libraries and languages are sort of re-implementing this iNet

A2N function by parsing strings essentially, which is very

difficult to get just right, meaning just the same way as the Sockets library interprets

these addresses. After all, in the end, a long unsigned integer or a 32-bit integer is the way how IP addresses

are in the end represented internally. So how you're converting from the string to the

integer, that's really where the vulnerabilities and the problems happen. So in short, if you

ever find yourself having to validate

an IP address, well, don't mix libraries, use some well validated libraries, and don't try to

rewrite your own INET A2N. And well, Apple's air tags are about two weeks old, at least two weeks out of in consumer

hands, and we got our first jailbroken air tax.

...