Updated tcpdump, libpcap, and arpwatch packages for iSeries and pSeries fix various vulnerabilities.
Tcpdump is a command-line tool for monitoring network traffic. The Red Hat tcpdump packages advertise that by default tcpdump will drop permissions to user 'pcap'. Due to a compilation error this did not happen, and tcpdump would run as root unless the '-U' flag was specified. Users of tcpdump are advised to upgrade to these errata packages, which are compiled so that by default tcpdump will drop privileges to the 'pcap' user. The BGP decoding routines in tcpdump before 3.6.2 used incorrect bounds checking when copying data, which allows remote attackers to cause a denial of service and possibly execute arbitrary code (as the 'pcap' user). The RADIUS decoder in tcpdump 3.6.2 and earlier allows remote attackers to cause a denial of service (crash) via an invalid RADIUS packet with a header length field of 0. This causes tcpdump to generate data within an infinite loop. A vulnerability in tcpdump before 3.7.2 is related to an inability to handle unknown RADIUS attributes properly, and allows remote attackers to cause a denial of service (infinite loop). The ISAKMP parser in tcpdump 3.6 through 3.7.1 allows remote attackers to cause a denial of service (CPU consumption) via a malformed ISAKMP packet to UDP port 500, causing tcpdump to enter an infinite loop. Versions of tcpdump up to and including 3.6.2 have a buffer overflow that can be triggered when tracing the network by a bad NFS packet. This issue was found by David Woodhouse of Red Hat. Users of tcpdump are advised to upgrade to these errata packages, which contain patches to correct these issues.