Risks
Advisories
Browse
or
or
Red Hat Security Advisory - Updated tcpdump packages fix buffer overflow
--------------------------------------------------------------------- 
                   Red Hat, Inc. Red Hat Security Advisory 


Synopsis: Updated tcpdump packages fix buffer overflow 
Advisory ID: RHSA-2002:094-08 
Issue date: 2002-05-17 
Updated on: 2002-05-29 
Product: Red Hat Linux 
Keywords: tcpdump arpwatch buffer overflow 
Cross references: 
Obsoletes: RHSA-2001:089-10 
CVE Names: CAN-2002-0380 
--------------------------------------------------------------------- 


1. Topic: 


Updated tcpdump, libpcap, and arpwatch packages are available for Red 
Hat Linux 6.2 and 7.x. These updates close a buffer overflow when handling 
NFS packets. 


2. Relevant releases/architectures: 


Red Hat Linux 6.2 - alpha, i386, sparc 


Red Hat Linux 7.0 - alpha, i386 


Red Hat Linux 7.1 - alpha, i386, ia64 


Red Hat Linux 7.2 - i386, ia64, s390 


3. Problem description: 


tcpdump is a command-line tool for monitoring network traffic. Versions of 
tcpdump up to and including 3.6.2 have a buffer overflow that can be 
triggered when tracing the network by a bad NFS packet. 


We are not yet aware if this issue is fully exploitable; however, users of 
tcpdump are advised to upgrade to these errata packages which contain a 
patch for this issue. 


The Common Vulnerabilities and Exposures project (cve.mitre.org) has 
assigned the name CAN-2002-0380 to this issue. This issue was found by 
David Woodhouse of Red Hat. 


4. Solution: 


Before applying this update, make sure all previously released errata 
relevant to your system have been applied. 


To update all RPMs for your particular architecture, run: 


rpm -Fvh [filenames] 


where [filenames] is a list of the RPMs you wish to upgrade. Only those 
RPMs which are currently installed will be updated. Those RPMs which are 
not installed but included in the list will not be updated. Note that you 
can also use wildcards (*.rpm) if your current directory *only* contains the 
desired RPMs. 


Please note that this update is also available via Red Hat Network. Many 
people find this an easier way to apply updates. To use Red Hat Network, 
launch the Red Hat Update Agent with the following command: 


up2date 


This will start an interactive process that will result in the appropriate 
RPMs being upgraded on your system. 


5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info): 


55145 - tcpdump segfaults when displaying NFS traffic. 
63113 - Start script refers to non/existing /etc/init.d directory 


6. RPMs required: 


Red Hat Linux 6.2: 


SRPMS: 
ftp://updates.redhat.com/6.2/en/os/SRPMS/tcpdump-3.6.2-11.6.2.0.src.rpm 


alpha: 
ftp://updates.redhat.com/6.2/en/os/alpha/tcpdump-3.6.2-11.6.2.0.alpha.rpm 
ftp://updates.redhat.com/6.2/en/os/alpha/libpcap-0.6.2-11.6.2.0.alpha.rpm 
ftp://updates.redhat.com/6.2/en/os/alpha/arpwatch-2.1a11-11.6.2.0.alpha.rpm 


i386: 
ftp://updates.redhat.com/6.2/en/os/i386/tcpdump-3.6.2-11.6.2.0.i386.rpm 
ftp://updates.redhat.com/6.2/en/os/i386/libpcap-0.6.2-11.6.2.0.i386.rpm 
ftp://updates.redhat.com/6.2/en/os/i386/arpwatch-2.1a11-11.6.2.0.i386.rpm 


sparc: 
ftp://updates.redhat.com/6.2/en/os/sparc/tcpdump-3.6.2-11.6.2.0.sparc.rpm 
ftp://updates.redhat.com/6.2/en/os/sparc/libpcap-0.6.2-11.6.2.0.sparc.rpm 
ftp://updates.redhat.com/6.2/en/os/sparc/arpwatch-2.1a11-11.6.2.0.sparc.rpm 


Red Hat Linux 7.0: 


SRPMS: 
ftp://updates.redhat.com/7.0/en/os/SRPMS/tcpdump-3.6.2-11.7.0.0.src.rpm 


alpha: 
ftp://updates.redhat.com/7.0/en/os/alpha/tcpdump-3.6.2-11.7.0.0.alpha.rpm 
ftp://updates.redhat.com/7.0/en/os/alpha/libpcap-0.6.2-11.7.0.0.alpha.rpm 
ftp://updates.redhat.com/7.0/en/os/alpha/arpwatch-2.1a11-11.7.0.0.alpha.rpm 


i386: 
ftp://updates.redhat.com/7.0/en/os/i386/tcpdump-3.6.2-11.7.0.0.i386.rpm 
ftp://updates.redhat.com/7.0/en/os/i386/libpcap-0.6.2-11.7.0.0.i386.rpm 
ftp://updates.redhat.com/7.0/en/os/i386/arpwatch-2.1a11-11.7.0.0.i386.rpm 


Red Hat Linux 7.1: 


SRPMS: 
ftp://updates.redhat.com/7.1/en/os/SRPMS/tcpdump-3.6.2-11.7.1.0.src.rpm 


alpha: 
ftp://updates.redhat.com/7.1/en/os/alpha/tcpdump-3.6.2-11.7.1.0.alpha.rpm 
ftp://updates.redhat.com/7.1/en/os/alpha/libpcap-0.6.2-11.7.1.0.alpha.rpm 
ftp://updates.redhat.com/7.1/en/os/alpha/arpwatch-2.1a11-11.7.1.0.alpha.rpm 


i386: 
ftp://updates.redhat.com/7.1/en/os/i386/tcpdump-3.6.2-11.7.1.0.i386.rpm 
ftp://updates.redhat.com/7.1/en/os/i386/libpcap-0.6.2-11.7.1.0.i386.rpm 
ftp://updates.redhat.com/7.1/en/os/i386/arpwatch-2.1a11-11.7.1.0.i386.rpm 


ia64: 
ftp://updates.redhat.com/7.1/en/os/ia64/tcpdump-3.6.2-11.7.1.0.ia64.rpm 
ftp://updates.redhat.com/7.1/en/os/ia64/libpcap-0.6.2-11.7.1.0.ia64.rpm 
ftp://updates.redhat.com/7.1/en/os/ia64/arpwatch-2.1a11-11.7.1.0.ia64.rpm 


Red Hat Linux 7.2: 


SRPMS: 
ftp://updates.redhat.com/7.2/en/os/SRPMS/tcpdump-3.6.2-11.7.2.0.src.rpm 


i386: 
ftp://updates.redhat.com/7.2/en/os/i386/tcpdump-3.6.2-11.7.2.0.i386.rpm 
ftp://updates.redhat.com/7.2/en/os/i386/libpcap-0.6.2-11.7.2.0.i386.rpm 
ftp://updates.redhat.com/7.2/en/os/i386/arpwatch-2.1a11-11.7.2.0.i386.rpm 


ia64: 
ftp://updates.redhat.com/7.2/en/os/ia64/tcpdump-3.6.2-11.7.2.0.ia64.rpm 
ftp://updates.redhat.com/7.2/en/os/ia64/libpcap-0.6.2-11.7.2.0.ia64.rpm 
ftp://updates.redhat.com/7.2/en/os/ia64/arpwatch-2.1a11-11.7.2.0.ia64.rpm 




7. Verification: 


MD5 sum Package Name 
-------------------------------------------------------------------------- 
d31951e4a06b8c08c1e39abfd0b13955 6.2/en/os/SRPMS/tcpdump-3.6.2-11.6.2.0.src.rpm 
b06ccff8c19676918f60bf2708daf1ad 6.2/en/os/alpha/arpwatch-2.1a11-11.6.2.0.alpha.rpm 
4da963c19df79272f2f97c219206a04e 6.2/en/os/alpha/libpcap-0.6.2-11.6.2.0.alpha.rpm 
bb5ca0570255798bcccf651e4169f45c 6.2/en/os/alpha/tcpdump-3.6.2-11.6.2.0.alpha.rpm 
47a2bf8d8534d8e70530d9c394da8f92 6.2/en/os/i386/arpwatch-2.1a11-11.6.2.0.i386.rpm 
05b1442e28f961440c4345e5a7f9d4d8 6.2/en/os/i386/libpcap-0.6.2-11.6.2.0.i386.rpm 
f617a999adeff7a71b557eef6a6271a9 6.2/en/os/i386/tcpdump-3.6.2-11.6.2.0.i386.rpm 
629b18c6f91d21a2b503d05349e331a0 6.2/en/os/sparc/arpwatch-2.1a11-11.6.2.0.sparc.rpm 
b0f50ae9d447bbe40c411cc4c66215a3 6.2/en/os/sparc/libpcap-0.6.2-11.6.2.0.sparc.rpm 
e9317d5b6b2c473a44c6fed9ec7c25fc 6.2/en/os/sparc/tcpdump-3.6.2-11.6.2.0.sparc.rpm 
b1abeb15f7a85fb77827e848737c9949 7.0/en/os/SRPMS/tcpdump-3.6.2-11.7.0.0.src.rpm 
75f65e70953953b346359967a89a1980 7.0/en/os/alpha/arpwatch-2.1a11-11.7.0.0.alpha.rpm 
3418be3679d89faa81a0732dba448897 7.0/en/os/alpha/libpcap-0.6.2-11.7.0.0.alpha.rpm 
659f8cb30777c5022c52a54d96baca54 7.0/en/os/alpha/tcpdump-3.6.2-11.7.0.0.alpha.rpm 
098c900c75d194402fade5528b2263ca 7.0/en/os/i386/arpwatch-2.1a11-11.7.0.0.i386.rpm 
186da1899fea780a15501354de5d6715 7.0/en/os/i386/libpcap-0.6.2-11.7.0.0.i386.rpm 
db064ed0c0b16986b92e97bf2492c945 7.0/en/os/i386/tcpdump-3.6.2-11.7.0.0.i386.rpm 
27bf8dea340db81f1e946356c6bef684 7.1/en/os/SRPMS/tcpdump-3.6.2-11.7.1.0.src.rpm 
a677cec9114214c2ea5e5b17e709883d 7.1/en/os/alpha/arpwatch-2.1a11-11.7.1.0.alpha.rpm 
f7b8cf962abe27d65d628dae5cb992bd 7.1/en/os/alpha/libpcap-0.6.2-11.7.1.0.alpha.rpm 
755e2fa9fb0530735e03388f702cfd38 7.1/en/os/alpha/tcpdump-3.6.2-11.7.1.0.alpha.rpm 
edc6718ed479661f40c929da92b4e24b 7.1/en/os/i386/arpwatch-2.1a11-11.7.1.0.i386.rpm 
4e1a186b4287de4183a7fca4d868906e 7.1/en/os/i386/libpcap-0.6.2-11.7.1.0.i386.rpm 
2eb63c329def52d1bcdd88f8b3d01841 7.1/en/os/i386/tcpdump-3.6.2-11.7.1.0.i386.rpm 
17319e98b00c707f8c924766f0395aad 7.1/en/os/ia64/arpwatch-2.1a11-11.7.1.0.ia64.rpm 
8a214b04f325451eecaf08574ebacc7a 7.1/en/os/ia64/libpcap-0.6.2-11.7.1.0.ia64.rpm 
90db41ce76a94d2d10369437704bb934 7.1/en/os/ia64/tcpdump-3.6.2-11.7.1.0.ia64.rpm 
1cfcf4efdad9c8d44f9c70a9da8da690 7.2/en/os/SRPMS/tcpdump-3.6.2-11.7.2.0.src.rpm 
82f93afd069a3b85ddf5a44daeff589f 7.2/en/os/i386/arpwatch-2.1a11-11.7.2.0.i386.rpm 
f26ebb5d1cbb91d4b5effd9174f1728d 7.2/en/os/i386/libpcap-0.6.2-11.7.2.0.i386.rpm 
cc168b456fbde106ad1879fe7346c1ee 7.2/en/os/i386/tcpdump-3.6.2-11.7.2.0.i386.rpm 
74863a3b3110d2dbb03a03c1ad213152 7.2/en/os/ia64/arpwatch-2.1a11-11.7.2.0.ia64.rpm 
876adc0c4d794e75a48e5c6b87fbca45 7.2/en/os/ia64/libpcap-0.6.2-11.7.2.0.ia64.rpm 
f7543f13b1734c779cafd600566569b2 7.2/en/os/ia64/tcpdump-3.6.2-11.7.2.0.ia64.rpm 
  


These packages are GPG signed by Red Hat, Inc. for security. Our key 
is available at: 
    http://www.redhat.com/about/contact/pgpkey.html 


You can verify each package with the following command: 
    rpm --checksig <filename> 


If you only wish to verify that each package has not been corrupted or 
tampered with, examine only the md5sum with the following command: 
    rpm --checksig --nogpg <filename> 


8. References: 



http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0380 




Copyright(c) 2000, 2001, 2002 Red Hat, Inc. 




Spotlight

Lessons learned developing Lynis, an open source security auditing tool

Posted on 15 October 2014.  |  Lynis unearths vulnerabilities, configuration errors, and provides tips for system hardening. It is written in shell script, installation is not required and can be performed with a privileged or non-privileged account.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Oct 17th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //