Rapid7 Vulnerability & Exploit Database

RHSA-2003:214: Updated tcpdump packages fix various vulnerabilities

Back to Search

RHSA-2003:214: Updated tcpdump packages fix various vulnerabilities

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
06/18/2002
Created
07/25/2018
Added
10/28/2005
Modified
07/04/2017

Description

Updated tcpdump, libpcap, and arpwatch packages for iSeries and pSeries fix various vulnerabilities.

Tcpdump is a command-line tool for monitoring network traffic. The Red Hat tcpdump packages advertise that by default tcpdump will drop permissions to user 'pcap'. Due to a compilation error this did not happen, and tcpdump would run as root unless the '-U' flag was specified. Users of tcpdump are advised to upgrade to these errata packages, which are compiled so that by default tcpdump will drop privileges to the 'pcap' user. The BGP decoding routines in tcpdump before 3.6.2 used incorrect bounds checking when copying data, which allows remote attackers to cause a denial of service and possibly execute arbitrary code (as the 'pcap' user). The RADIUS decoder in tcpdump 3.6.2 and earlier allows remote attackers to cause a denial of service (crash) via an invalid RADIUS packet with a header length field of 0. This causes tcpdump to generate data within an infinite loop. A vulnerability in tcpdump before 3.7.2 is related to an inability to handle unknown RADIUS attributes properly, and allows remote attackers to cause a denial of service (infinite loop). The ISAKMP parser in tcpdump 3.6 through 3.7.1 allows remote attackers to cause a denial of service (CPU consumption) via a malformed ISAKMP packet to UDP port 500, causing tcpdump to enter an infinite loop. Versions of tcpdump up to and including 3.6.2 have a buffer overflow that can be triggered when tracing the network by a bad NFS packet. This issue was found by David Woodhouse of Red Hat. Users of tcpdump are advised to upgrade to these errata packages, which contain patches to correct these issues.

Solution(s)

  • redhat-upgrade-arpwatch
  • redhat-upgrade-libpcap
  • redhat-upgrade-tcpdump

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;