CVE-2017-3533

app("2017 APRIL CPU"):
    requires(version: "ARMR/2.6")

    /***************************************************************************
        CVE-2017-3533 (2017 APRIL CPU)

        CVSS 3.0 Summary:
            Base Score              | 3.7 LOW
            Attack Vector           | Network
            Attack Complexity       | High
            Privileges Required     | None
            User Interaction        | None
            Scope                   | Unchanged
            Confidentiality Impact  | None
            Integrity Impact        | Low
            Availability Impact     | None

        Description:
            A newline injection flaw was discovered in the FTP client
            implementation in the Networking component in OpenJDK. A remote
            attacker could possibly use this flaw to manipulate FTP connections
            established by a Java application.

        Resources:
            https://bugzilla.redhat.com/show_bug.cgi?id=1443083

        Affected Versions:
            6u141, 7u131, 8u121, JRockit R28.3.13

        Fixed Versions:
            6u151, 7u141, 8u131

        Tested Versions:
            6u0 - 6u141
            7u0 - 7u131
            8u0 - 8u121

        Protection Provided:
            Functional

        Patch Version:
            1.2
    ***************************************************************************/

    patch("CVE-2017-3533 :01"):
        function("sun/net/ftp/FtpClient.issueCommand(Ljava/lang/String;)I",
            checksums: ["990f14b4b4"])  // 6u0 - 6u141
        callsite("sun/net/ftp/FtpClient.sendServer(Ljava/lang/String;)V")

        code(language: java):
            private static JavaMethod ftpProtocolExceptionConstructorMethod;

            public void load() {
                ftpProtocolExceptionConstructorMethod = JavaMethod.load("sun/net/ftp/FtpProtocolException.<init>(Ljava/lang/String;)V");
            }

            public void patch(JavaFrame frame) throws Exception {
                String cmd = (String) frame.loadStringParam(1);
                if (cmd.indexOf('\n') != -1) {
                    Exception ex = (Exception) ftpProtocolExceptionConstructorMethod.call(null, "Illegal FTP command");
                    ex.initCause(new IllegalArgumentException("Illegal carriage return"));
                    frame.raiseException(ex);
                }
            }
        endcode
    endpatch

    patch("CVE-2017-3533 :02"):
        function("sun/net/ftp/impl/FtpClient.issueCommand(Ljava/lang/String;)Z",
            checksums: ["db7e2a877f",   // 7u0  - 7u21
                        "37087538ae",   // 7u25
                        "7c0853e6aa",   // 7u40 - 7u121
                        "c275304d7b",   // 7u131
                        "f83e0307ee"])  // 8u0  - 8u121
        callsite("sun/net/ftp/impl/FtpClient.sendServer(Ljava/lang/String;)V")

        code(language: java,   import: ["sun.net.ftp.FtpProtocolException"]):
            public void patch(JavaFrame frame) throws Exception {
                String cmd = frame.loadStringVariable(1);
                if (cmd.indexOf('\n') != -1) {
                    FtpProtocolException ex = new FtpProtocolException("Illegal FTP command");
                    ex.initCause(new IllegalArgumentException("Illegal carriage return"));
                    frame.raiseException(ex);
                }
            }
        endcode
    endpatch

endapp