Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » Conectiva CLA-2003:629: tcpdump multiple vulnerabilities

Conectiva CLA-2003:629: tcpdump multiple vulnerabilities

by Nikola Strahija on April 24th, 2003 Several vulnerabilities have been found in the TcpDump program which, if exploited, could allow buffer overflow and other attacks.


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --------------------------------------------------------------------------

PACKAGE : tcpdump
SUMMARY : Several vulnerabilities
DATE : 2003-04-22 12:13:00
ID : CLA-2003:629
RELEVANT
RELEASES : 6.0, 7.0, 8

- -------------------------------------------------------------------------

DESCRIPTION
Tcpdump is a command-line tool for monitoring network traffic.

This update fixes several vulnerabilities found in tcpdump:

- Infinite loop vulnerability[1] when parsing ISAKMP packets.
A remote atacker can cause tcpdump to enter an infinite loop by
injecting specially crafted ISAKMP packets (UDP port 500) in the
network being monitored by it. This vulnerability was discovered by
Andrew Griffiths and iDEFENSE Labs and has the name CVE-2003-0108
assigned[2] by the Common Vulnerabilities and Exposures (CVE)
project.

- Infinite loop vulnerability when parsing BGP packets.
This vulnerability can be exploited in a similar way of the previous
one, but using BGP packets. It was discovered by the tcpdump
developers.

- Buffer overflow when parsing NFS traffic.
tcpdump fails to check the boundaries of some buffers when parsing
NFS traffic. A remote atacker can exploit this vulnerability to crash
the tcpdump process or to potentially execute arbitrary code with the
privileges of the user running it (tcpdump is usually run by the root
user). This vulnerability was discovered by the tcpdump developers.

Even though libpcap is not affected by these vulnerabilities, new
packages are being provided for Conectiva Linux 6.0 and 7.0 because
they are generated together with tcpdump from the same SRPM package.


SOLUTION
All tcpdump users should upgrade.

Please note that the packages listed in this announcement are
available in our FTP servers since March 10th, 2003.


REFERENCES:
1.http://www.idefense.com/advisory/02.27.03.txt
2.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0108
3.http://www.tcpdump.org/tcpdump-changes.txt


UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/libpcap-0.6.2-1U60_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/libpcap-devel-0.6.2-1U60_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/libpcap-devel-static-0.6.2-1U60_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/tcpdump-3.6.2-1U60_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/tcpdump-3.6.2-1U60_3cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/libpcap-0.6.2-1U70_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/libpcap-devel-0.6.2-1U70_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/libpcap-devel-static-0.6.2-1U70_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/tcpdump-3.6.2-1U70_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/tcpdump-3.6.2-1U70_3cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/tcpdump-3.6.2-3U80_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/tcpdump-3.6.2-3U80_3cl.src.rpm


ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:

- run: apt-get update
- after that, execute: apt-get upgrade

Detailed instructions reagarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en

- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en

- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
Copyright (c) 2003 Conectiva Inc.
http://www.conectiva.com

- -------------------------------------------------------------------------
subscribe: [email protected]
unsubscribe: [email protected]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE+pVxy42jd0JmAcZARAhahAJ9AYyTbUXOSZWM3aapZrcPJ+4MebQCdFi4e
b++dTVqz4fCOtGgLe7/3SOY=
=34oD
-----END PGP SIGNATURE-----


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »