Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » MDKSA-2002:032-tcpdump

MDKSA-2002:032-tcpdump

by Nikola Strahija on May 19th, 2002 Several buffer overflows were found in the tcpdump package by FreeBSD developers during a code audit, in versions prior to 3.5. However, newer versions of tcpdump, including 3.6.2, are also vulnerable to another buffer overflow in the AFS RPC decoding functions, which was discovered by Nick Cleaton. These vulnerabilities could be used by a remote attacker to crash the the tcpdump process or possibly even be exploited to execute arbitrary code as the user running tcpdump, which is usually root. The newer libpcap 0.6 has also been audited to make it more safe by implementing better buffer boundary checks in several functions.


References:

http://www.ciac.org/ciac/bulletins/l-015.shtml
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:48.tcpdump.asc
________________________________________________________________________

Updated Packages:

Linux-Mandrake 7.1:
a17ec464d576bdbd870dc6a5d25fc59d 7.1/RPMS/libpcap-0.6.2-3.2mdk.i586.rpm
ed780612ab8620e84e8310432a5df0b9 7.1/RPMS/libpcap-devel-0.6.2-3.2mdk.i586.rpm
a186519910760e36b7e50456412ab20e 7.1/RPMS/tcpdump-3.6.2-2.2mdk.i586.rpm
5e6091d2f916b180ffc80d60e2005a49 7.1/SRPMS/libpcap-0.6.2-3.2mdk.src.rpm
a997724147a333e27e72670bff28e5ee 7.1/SRPMS/tcpdump-3.6.2-2.2mdk.src.rpm

Linux-Mandrake 7.2:
e39a58560c3ec60a574c63dd9e383fda 7.2/RPMS/libpcap-0.6.2-3.2mdk.i586.rpm
4600b4d1a435d17a77560a36e28ddc70 7.2/RPMS/libpcap-devel-0.6.2-3.2mdk.i586.rpm
fc014253b27e44c8a230f936d7eadf9e 7.2/RPMS/tcpdump-3.6.2-2.2mdk.i586.rpm
5e6091d2f916b180ffc80d60e2005a49 7.2/SRPMS/libpcap-0.6.2-3.2mdk.src.rpm
a997724147a333e27e72670bff28e5ee 7.2/SRPMS/tcpdump-3.6.2-2.2mdk.src.rpm

Mandrake Linux 8.0:
d8deeabab302271054ecad942a14013e 8.0/RPMS/libpcap0-0.6.2-3.1mdk.i586.rpm
b2aa6d27578b8699640b6ed2e76ba228
8.0/RPMS/libpcap0-devel-0.6.2-3.1mdk.i586.rpm
16eac5435d8b8e1075c10d393a2914a5 8.0/RPMS/tcpdump-3.6.2-2.1mdk.i586.rpm
4b1956a781b1185e693a26037d4804a5 8.0/SRPMS/libpcap-0.6.2-3.1mdk.src.rpm
683c3b6f0ae7754090cbcf480cd731b0 8.0/SRPMS/tcpdump-3.6.2-2.1mdk.src.rpm

Mandrake Linux 8.0/ppc:
4a4f5cca7fc50d1616b857b89afe3ae3 ppc/8.0/RPMS/libpcap0-0.6.2-3.1mdk.ppc.rpm
11be44f15a54a9654cd48b5b8aed04ba
ppc/8.0/RPMS/libpcap0-devel-0.6.2-3.1mdk.ppc.rpm
68255f8f80d88b91fd488d6379db81df ppc/8.0/RPMS/tcpdump-3.6.2-2.1mdk.ppc.rpm
4b1956a781b1185e693a26037d4804a5 ppc/8.0/SRPMS/libpcap-0.6.2-3.1mdk.src.rpm
683c3b6f0ae7754090cbcf480cd731b0 ppc/8.0/SRPMS/tcpdump-3.6.2-2.1mdk.src.rpm

Mandrake Linux 8.1:
39715d1c613144e859f0386ee583377a 8.1/RPMS/tcpdump-3.6.2-2.1mdk.i586.rpm
683c3b6f0ae7754090cbcf480cd731b0 8.1/SRPMS/tcpdump-3.6.2-2.1mdk.src.rpm

Mandrake Linux 8.1/ia64:
6331901e596e243099aa6474481ea88a ia64/8.1/RPMS/tcpdump-3.6.2-2.1mdk.ia64.rpm
683c3b6f0ae7754090cbcf480cd731b0 ia64/8.1/SRPMS/tcpdump-3.6.2-2.1mdk.src.rpm

Mandrake Linux 8.2:
8c36a78c9a086c2d582d70d431533650 8.2/RPMS/tcpdump-3.6.2-2.1mdk.i586.rpm
683c3b6f0ae7754090cbcf480cd731b0 8.2/SRPMS/tcpdump-3.6.2-2.1mdk.src.rpm

Mandrake Linux 8.2/ppc:
081041c2713a9c76c5bf2fc727a03c45 ppc/8.2/RPMS/tcpdump-3.6.2-2.1mdk.ppc.rpm
683c3b6f0ae7754090cbcf480cd731b0 ppc/8.2/SRPMS/tcpdump-3.6.2-2.1mdk.src.rpm

Corporate Server 1.0.1:
a17ec464d576bdbd870dc6a5d25fc59d 1.0.1/RPMS/libpcap-0.6.2-3.2mdk.i586.rpm
ed780612ab8620e84e8310432a5df0b9
1.0.1/RPMS/libpcap-devel-0.6.2-3.2mdk.i586.rpm
a186519910760e36b7e50456412ab20e 1.0.1/RPMS/tcpdump-3.6.2-2.2mdk.i586.rpm
5e6091d2f916b180ffc80d60e2005a49 1.0.1/SRPMS/libpcap-0.6.2-3.2mdk.src.rpm
a997724147a333e27e72670bff28e5ee 1.0.1/SRPMS/tcpdump-3.6.2-2.2mdk.src.rpm

Single Network Firewall 7.2:
e39a58560c3ec60a574c63dd9e383fda snf7.2/RPMS/libpcap-0.6.2-3.2mdk.i586.rpm
4600b4d1a435d17a77560a36e28ddc70
snf7.2/RPMS/libpcap-devel-0.6.2-3.2mdk.i586.rpm
fc014253b27e44c8a230f936d7eadf9e snf7.2/RPMS/tcpdump-3.6.2-2.2mdk.i586.rpm
5e6091d2f916b180ffc80d60e2005a49 snf7.2/SRPMS/libpcap-0.6.2-3.2mdk.src.rpm
a997724147a333e27e72670bff28e5ee snf7.2/SRPMS/tcpdump-3.6.2-2.2mdk.src.rpm
________________________________________________________________________

Bug IDs fixed (see https://qa.mandrakesoft.com for more information):

________________________________________________________________________

To upgrade automatically, use MandrakeUpdate. The verification of md5
checksums and GPG signatures is performed automatically for you.

If you want to upgrade manually, download the updated package from one
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm". A list of
FTP mirrors can be obtained from:

http://www.mandrakesecure.net/en/ftp.php

Please verify the update prior to upgrading to ensure the integrity of
the downloaded package. You can do this with the command:

rpm --checksig

All packages are signed by MandrakeSoft for security. You can obtain
the GPG public key of the Mandrake Linux Security Team from:

https://www.mandrakesecure.net/RPM-GPG-KEYS

Please be aware that sometimes it takes the mirrors a few hours to
update.

You can view other update advisories for Mandrake Linux at:

http://www.mandrakesecure.net/en/advisories/

MandrakeSoft has several security-related mailing list services that
anyone can subscribe to. Information on these lists can be obtained by
visiting:

http://www.mandrakesecure.net/en/mlist.php

If you want to report vulnerabilities, please contact

[email protected]


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »