sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

[SM-Security] tcpdump Denial of Service vulnerability

From: Thomas Houssin <thomas.houssin AT gmail.com>
To: sm-security AT lists.ibiblio.org
Subject: [SM-Security] tcpdump Denial of Service vulnerability
Date: Tue, 10 May 2005 20:09:33 +0200

Synopsis
========
A flaw in the decoding of network packets in tcpdump allows remote
attackers to cause a denial of service (infinite loop)

Background
==========
tcpdump is CLI packet sniffer network debugging tool

Description
===========
CAN-2005-1279: tcpdump 3.8.3 and earlier allows remote attackers to
cause a denial of service (infinite loop) via a crafted (1) BGP packet,
which is not properly handled by RT_ROUTING_INFO, or (2) LDP packet,
which is not properly handled by the ldp_print function.

CAN-2005-1280: The rsvp_print function in tcpdump 3.9.1 and earlier
allows remote attackers to cause a denial of service (infinite loop) via
a crafted RSVP packet of length 4.

Affected packages
=================
tcpdump 1.8.3, present in devel, test and stable, is affected ; this is
now fixed in all grimoires.

Resolution
==========
All tcpdump users should upgrade to the latest available version:
#scribe update
#cast -c tcpdump

--
Thomas Houssin

Security Team Lead : Source Mage GNU/Linux http://www.sourcemage.org
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature

[SM-Security] tcpdump Denial of Service vulnerability, Thomas Houssin, 05/10/2005