CVE-2017-3544

app("2017 APRIL CPU"):
    requires(version: "ARMR/2.6")

    /***************************************************************************
        CVE-2017-3544 (2017 APRIL CPU)

        CVSS 3.0 Summary:
            Base Score              | 3.7 LOW
            Access Vector           | Network
            Access Complexity       | High
            Privileges Required     | None
            User Interaction        | None
            Confidentiality Impact  | None
            Integrity Impact        | Low
            Availability Impact     | None

        Description:
            A newline injection flaw was discovered in the SMTP client
            implementation in the Networking component in OpenJDK. A remote
            attacker could possibly use this flaw to manipulate SMTP connections
            established by a Java application.

        Resources:
            https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-3544

        Affected Versions:
            6u141, 7u131, 8u121, JRockit R28.3.13

        Tested Versions:
            6u0 - 6u141
            7u0 - 7u131
            8u0 - 8u121

        Protection Provided:
            Functional

        Patch Version:
            1.0
    ***************************************************************************/

    patch("CVE-2017-3544 :01"):
        function("sun/net/smtp/SmtpClient.to(Ljava/lang/String;)V",
            checksums: ["d98bf8eb2e",   // 6u0 - 6u141, 7u0 - 7u131
                        "65b1d45aac"])  // 8u0 - 8u121
        entry()

        code(language: java,   import: ["java.io.IOException"]):
            public void patch(JavaFrame frame) {
                String s = (String)frame.loadStringParam(1);
                if (s.indexOf('\n') != -1) {
                    frame.raiseException( new IOException("Illegal SMTP command",
                        new IllegalArgumentException("Illegal carriage return")));
                }
            }
        endcode
    endpatch

    patch("CVE-2017-3544 :02"):
        function("sun/net/smtp/SmtpClient.from(Ljava/lang/String;)V",
            checksums: ["d98bf8eb2e",   // 6u0 - 6u141, 7u0 - 7u131
                        "65b1d45aac"])  // 8u0 - 8u121
        entry()

        code(language: java,   import: ["java.io.IOException",
                                        "sun.net.smtp.SmtpClient"]):

            private JavaMethod issueCommandMethod;

            public void load() {
                issueCommandMethod = JavaMethod.load("sun/net/smtp/SmtpClient.issueCommand(Ljava/lang/String;I)V");
            }

            public void patch(JavaFrame frame) {
                SmtpClient client = (SmtpClient) frame.loadThisVariable();
                String s = (String) frame.loadStringVariable(1);

                if (s.indexOf('\n') != -1) {
                    frame.raiseException(new IOException("Illegal SMTP command",
                        new IllegalArgumentException("Illegal carriage return")));
                    return;
                }

                if (s.startsWith("<")) {
                    issueCommandMethod.call(client, "mail from: " + s + "\r\n", 250);
                } else {
                    issueCommandMethod.call(client, "mail from: <" + s + ">\r\n", 250);
                }
                frame.returnVoid();
            }
        endcode
    endpatch

endapp