Updated: June 07, 2002
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
Caldera has released Caldera Security Advisory CSSA-2002-025.
Updated: June 07, 2002
Affected
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1 CONECTIVA LINUX SECURITY ANNOUNCEMENT PACKAGE : tcpdump
SUMMARY : Several vulnerabilities
DATE : 2002-05-07 18:23:00
ID : CLA-2002:480
RELEVANT
RELEASES : 5.0, 5.1, 6.0, 7.0, 8 DESCRIPTION
Tcpdump is a command-line tool for monitoring network traffic. It
uses libpcap, a library which provides a portable framework for
low-level network monitoring. Both are developed by the same
team[1]. This advisory addresses problems found in both projects. tcpdump buffer overflows: during a tcpdump code auditing done by
FreeBSD developers, several buffer overflows were discovered[2] in
tcpdump versions prior to 3.5. New versions (including 3.6.2) are
also vulnerable to another buffer overflow[3] in AFS RPC decoding
functions, as pointed out by Nick Cleaton
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Updated: June 07, 2002
Affected
-----BEGIN PGP SIGNED MESSAGE----- FreeBSD-SA-00:61 Security Advisory FreeBSD, Inc. Topic: tcpdump contains remote vulnerabilities [REISSUED] Category: core Module: tcpdump Announced: 2000-10-31 Reissued: 2000-11-06 Credits: Discovered during internal auditing. Affects: All releases of FreeBSD 3.x, 4.x prior to 4.2 FreeBSD 3.5.1-STABLE and 4.1.1-STABLE prior to the correction date Corrected: 2000-10-04 (FreeBSD 4.1.1-STABLE) 2000-10-05 (FreeBSD 3.5.1-STABLE) Vendor status: Patch released FreeBSD only: NO 0. Revision History v1.0 2000-10-31 Initial release v1.1 2000-11-06 Corrected patch I. Background tcpdump is a tool for monitoring network activity. II. Problem Description Several overflowable buffers were discovered in the version of tcpdump included in FreeBSD, during internal source code auditing. Some simply allow the remote attacker to crash the local tcpdump process, but there is a more serious vulnerability in the decoding of AFS ACL packets in the more recent version of tcpdump (tcpdump 3.5) included in FreeBSD 4.0-RELEASE, 4.1-RELEASE and 4.1.1-RELEASE, which may allow a remote attacker to execute arbitrary code on the local system (usually root, since root privileges are required to run tcpdump). The former issue may be a problem for systems using tcpdump as a form of intrusion detection system, i.e. to monitor suspicious network activity: after the attacker crashes any listening tcpdump processes their subsequent activities will not be observed. All released versions of FreeBSD prior to the correction date including 3.5.1-RELEASE, 4.0-RELEASE, 4.1-RELEASE and 4.1.1-RELEASE are vulnerable to the "remote crash" problems, and FreeBSD 4.0-RELEASE, 4.1-RELEASE and 4.1.1-RELEASE are also vulnerable to the "remote execution" vulnerability. Both problems were corrected in 4.1.1-STABLE prior to the release of FreeBSD 4.2-RELEASE. III. Impact Remote users can cause the local tcpdump process to crash, and (under FreeBSD 4.0-RELEASE, 4.1-RELEASE, 4.1.1-RELEASE and 4.1.1-STABLE prior to the correction date) may be able to cause arbitrary code to be executed as the user running tcpdump, usually root. IV. Workaround Do not use vulnerable versions of tcpdump in network environments which may contain packets from untrusted sources. V. Solution One of the following: 1) Upgrade your vulnerable FreeBSD system to 4.1.1-STABLE or 3.5.1-STABLE after the respective correction dates. 2a) FreeBSD 3.x systems prior to the correction date Download the patch and the detached PGP signature from the following locations, and verify the signature using your PGP utility. ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:61/tcpdump-3.x.patch ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:61/tcpdump-3.x.patch.asc # cd /usr/src/contrib/tcpdump # patch -p < /path/to/patch # cd /usr/src/usr.sbin/tcpdump # make depend && make all install 2b) FreeBSD 4.x systems prior to the correction date NOTE: The patch distributed with the original version of this advisory was incomplete and did not include all of the security fixes made to the tcpdump utility. In particular, it did not address the remote code execution vulnerability. Download the patch and the detached PGP signature from the following locations, and verify the signature using your PGP utility. ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:61/tcpdump-4.x.patch.v1.1 ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:61/tcpdump-4.x.patch.v1.1.asc # cd /usr/src/contrib/tcpdump # patch -p < /path/to/patch # cd /usr/src/usr.sbin/tcpdump # make depend && make all install -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.4 (FreeBSD) Comment: For info see http://www.gnupg.org iQCVAwUBOgcNKFUuHi5z0oilAQGYQAP9F00eE4rd0M46f8WMWTO7uFb1gV2p4Y0l KV0vT1wMy+PdmFNpo7SVrb/tdpa4Wtxb/Q/tu7RDZQqFI29yBPTFnE1iu8T2BSAm cO/dE5ypkjJkEjf8QjxqQXVhTbtIVVQa3Tosw3AdUFP0gKHUkZ36ryCQVxbqRMQK c0ZkdbwESp8= =uaOo -----END PGP SIGNATURE-----
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Updated: June 07, 2002
Affected
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1 Mandrake Linux Security Update Advisory Package name: tcpdump
Advisory ID: MDKSA-2002:032
Date: May 16th, 2002
Affected versions: 7.1, 7.2, 8.0, 8.1, 8.2, Corporate Server 1.0.1
Single Network Firewall 7.2 Problem Description: Several buffer overflows were found in the tcpdump package by FreeBSD
developers during a code audit, in versions prior to 3.5. However,
newer versions of tcpdump, including 3.6.2, are also vulnerable to
another buffer overflow in the AFS RPC decoding functions, which was
discovered by Nick Cleaton. These vulnerabilities could be used by
a remote attacker to crash the the tcpdump process or possibly even
be exploited to execute arbitrary code as the user running tcpdump,
which is usually root. The newer libpcap 0.6 has also been audited to make it more safe by
implementing better buffer boundary checks in several functions. References: http://www.ciac.org/ciac/bulletins/l-015.shtml
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:48.tcpdump.asc Updated Packages: Linux-Mandrake 7.1: a17ec464d576bdbd870dc6a5d25fc59d 7.1/RPMS/libpcap-0.6.2-3.2mdk.i586.rpm
ed780612ab8620e84e8310432a5df0b9 7.1/RPMS/libpcap-devel-0.6.2-3.2mdk.i586.rpm
a186519910760e36b7e50456412ab20e 7.1/RPMS/tcpdump-3.6.2-2.2mdk.i586.rpm
5e6091d2f916b180ffc80d60e2005a49 7.1/SRPMS/libpcap-0.6.2-3.2mdk.src.rpm
a997724147a333e27e72670bff28e5ee 7.1/SRPMS/tcpdump-3.6.2-2.2mdk.src.rpm Linux-Mandrake 7.2: e39a58560c3ec60a574c63dd9e383fda 7.2/RPMS/libpcap-0.6.2-3.2mdk.i586.rpm
4600b4d1a435d17a77560a36e28ddc70 7.2/RPMS/libpcap-devel-0.6.2-3.2mdk.i586.rpm
fc014253b27e44c8a230f936d7eadf9e 7.2/RPMS/tcpdump-3.6.2-2.2mdk.i586.rpm
5e6091d2f916b180ffc80d60e2005a49 7.2/SRPMS/libpcap-0.6.2-3.2mdk.src.rpm
a997724147a333e27e72670bff28e5ee 7.2/SRPMS/tcpdump-3.6.2-2.2mdk.src.rpm Mandrake Linux 8.0: d8deeabab302271054ecad942a14013e 8.0/RPMS/libpcap0-0.6.2-3.1mdk.i586.rpm
b2aa6d27578b8699640b6ed2e76ba228 8.0/RPMS/libpcap0-devel-0.6.2-3.1mdk.i586.rpm
16eac5435d8b8e1075c10d393a2914a5 8.0/RPMS/tcpdump-3.6.2-2.1mdk.i586.rpm
4b1956a781b1185e693a26037d4804a5 8.0/SRPMS/libpcap-0.6.2-3.1mdk.src.rpm
683c3b6f0ae7754090cbcf480cd731b0 8.0/SRPMS/tcpdump-3.6.2-2.1mdk.src.rpm Mandrake Linux 8.0/ppc: 4a4f5cca7fc50d1616b857b89afe3ae3 ppc/8.0/RPMS/libpcap0-0.6.2-3.1mdk.ppc.rpm
11be44f15a54a9654cd48b5b8aed04ba ppc/8.0/RPMS/libpcap0-devel-0.6.2-3.1mdk.ppc.rpm
68255f8f80d88b91fd488d6379db81df ppc/8.0/RPMS/tcpdump-3.6.2-2.1mdk.ppc.rpm
4b1956a781b1185e693a26037d4804a5 ppc/8.0/SRPMS/libpcap-0.6.2-3.1mdk.src.rpm
683c3b6f0ae7754090cbcf480cd731b0 ppc/8.0/SRPMS/tcpdump-3.6.2-2.1mdk.src.rpm Mandrake Linux 8.1: 39715d1c613144e859f0386ee583377a 8.1/RPMS/tcpdump-3.6.2-2.1mdk.i586.rpm
683c3b6f0ae7754090cbcf480cd731b0 8.1/SRPMS/tcpdump-3.6.2-2.1mdk.src.rpm Mandrake Linux 8.1/ia64: 6331901e596e243099aa6474481ea88a ia64/8.1/RPMS/tcpdump-3.6.2-2.1mdk.ia64.rpm
683c3b6f0ae7754090cbcf480cd731b0 ia64/8.1/SRPMS/tcpdump-3.6.2-2.1mdk.src.rpm Mandrake Linux 8.2: 8c36a78c9a086c2d582d70d431533650 8.2/RPMS/tcpdump-3.6.2-2.1mdk.i586.rpm
683c3b6f0ae7754090cbcf480cd731b0 8.2/SRPMS/tcpdump-3.6.2-2.1mdk.src.rpm Mandrake Linux 8.2/ppc: 081041c2713a9c76c5bf2fc727a03c45 ppc/8.2/RPMS/tcpdump-3.6.2-2.1mdk.ppc.rpm
683c3b6f0ae7754090cbcf480cd731b0 ppc/8.2/SRPMS/tcpdump-3.6.2-2.1mdk.src.rpm Corporate Server 1.0.1: a17ec464d576bdbd870dc6a5d25fc59d 1.0.1/RPMS/libpcap-0.6.2-3.2mdk.i586.rpm
ed780612ab8620e84e8310432a5df0b9 1.0.1/RPMS/libpcap-devel-0.6.2-3.2mdk.i586.rpm
a186519910760e36b7e50456412ab20e 1.0.1/RPMS/tcpdump-3.6.2-2.2mdk.i586.rpm
5e6091d2f916b180ffc80d60e2005a49 1.0.1/SRPMS/libpcap-0.6.2-3.2mdk.src.rpm
a997724147a333e27e72670bff28e5ee 1.0.1/SRPMS/tcpdump-3.6.2-2.2mdk.src.rpm Single Network Firewall 7.2: e39a58560c3ec60a574c63dd9e383fda snf7.2/RPMS/libpcap-0.6.2-3.2mdk.i586.rpm
4600b4d1a435d17a77560a36e28ddc70 snf7.2/RPMS/libpcap-devel-0.6.2-3.2mdk.i586.rpm
fc014253b27e44c8a230f936d7eadf9e snf7.2/RPMS/tcpdump-3.6.2-2.2mdk.i586.rpm
5e6091d2f916b180ffc80d60e2005a49 snf7.2/SRPMS/libpcap-0.6.2-3.2mdk.src.rpm
a997724147a333e27e72670bff28e5ee snf7.2/SRPMS/tcpdump-3.6.2-2.2mdk.src.rpm Bug IDs fixed (see https://qa.mandrakesoft.com for more information): To upgrade automatically, use MandrakeUpdate. The verification of md5
checksums and GPG signatures is performed automatically for you. If you want to upgrade manually, download the updated package from one
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm". A list of
FTP mirrors can be obtained from: http://www.mandrakesecure.net/en/ftp.php Please verify the update prior to upgrading to ensure the integrity of
the downloaded package. You can do this with the command: rpm --checksig
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Updated: June 07, 2002
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The Politecnico Di Torino ports tcpdump to the Windows platform as windump. The current (July 2002) version of windump is 3.6.2, which is vulnerable.
Updated: June 07, 2002
Affected
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
Red Hat has released Red Hat Security Advisory RHSA-2001:089.
Updated: June 12, 2002
Affected
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
Per tcpdump.org CVS annotations [http://cvs.tcpdump.org/cgi-bin/cvsweb/tcpdump/print-rx.c]: "Don't allow STROUT() to use a negative string length." See also [http://cvs.tcpdump.org/cgi-bin/cvsweb/tcpdump/print-rx.c?r1=1.22&r2=1.23].