dcsimg
Linux Today: Linux News On Internet Time.





More on LinuxToday


Conectiva Linux Announcement: tcpdump

May 07, 2002, 23:56 (0 Talkback[s])

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT 
- --------------------------------------------------------------------------

PACKAGE   : tcpdump
SUMMARY   : Several vulnerabilities
DATE      : 2002-05-07 18:23:00
ID        : CLA-2002:480
RELEVANT
RELEASES  : 5.0, 5.1, 6.0, 7.0, 8

- -------------------------------------------------------------------------

DESCRIPTION
 Tcpdump is a command-line tool for monitoring network traffic. It
 uses libpcap, a library which provides a portable framework for
 low-level network monitoring. Both are developed by the same
 team[1].
 
 This advisory addresses problems found in both projects.
 
 tcpdump buffer overflows: during a tcpdump code auditing done by
 FreeBSD developers, several buffer overflows were discovered[2] in
 tcpdump versions prior to 3.5. New versions (including 3.6.2) are
 also vulnerable to another buffer overflow[3] in AFS RPC decoding
 functions, as pointed out by Nick Cleaton <nick@cleaton.net>.

 These vulnerablities could be exploited by a remote attacker to crash
 the tcpdump process or even execute arbitrary code as the user
 running tcpdump (which usually is root).
 
 libpcap 0.6 has been audited and a better buffer boundary checking
 was implemented in several functions, thus making it more safe.
 
 This upgrade also fixes a lot of minor bugs[4] in both tcpdump and
 libpcap. Notice that the number of vulnerabilities and bug fixes
 which apply to every version of Conectiva Linux varies accordingly to
 the tcpdump/libpcap versions included in it. This update brings all
 packages to the most recent version as of this date plus the tcpdump
 security patches which have not yet been included in the upstream
 stable version (3.6.2).


SOLUTION
 All tcpdump users should upgrade their packages immediately. If
 you're only using libpcap, you should also consider upgrading since
 this new version solves several minor bugs.
 
 
 REFERENCES:
 1.http://www.tcpdump.org/
 2.http://www.ciac.org/ciac/bulletins/l-015.shtml
 3.ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:48.tcpdump.asc
 3.http://www.tcpdump.org/tcpdump-changes.txt

DIRECT DOWNLOAD LINKS TO THE UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/5.0/i386/arpwatch-2.1a11-9U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/libpcap-0.6.2-1U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/libpcap-devel-0.6.2-1U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/libpcap-devel-static-0.6.2-1U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/tcpdump-3.6.2-1U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/SRPMS/tcpdump-3.6.2-1U50_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/arpwatch-2.1a11-9U51_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/libpcap-0.6.2-1U51_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/libpcap-devel-0.6.2-1U51_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/libpcap-devel-static-0.6.2-1U51_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/tcpdump-3.6.2-1U51_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/SRPMS/tcpdump-3.6.2-1U51_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/arpwatch-2.1a11-9U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/libpcap-0.6.2-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/libpcap-devel-0.6.2-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/libpcap-devel-static-0.6.2-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/tcpdump-3.6.2-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/tcpdump-3.6.2-1U60_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/arpwatch-2.1a11-9U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/libpcap-0.6.2-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/libpcap-devel-0.6.2-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/libpcap-devel-static-0.6.2-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/tcpdump-3.6.2-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/tcpdump-3.6.2-1U70_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/libpcap-0.6.2-4U8_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/libpcap-devel-0.6.2-4U8_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/libpcap-devel-static-0.6.2-4U8_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/tcpdump-3.6.2-3U8_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/libpcap-0.6.2-4U8_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/tcpdump-3.6.2-3U8_1cl.src.rpm

ADDITIONAL INSTRUCTIONS
 Users of Conectiva Linux version 6.0 or higher may use apt to perform 
 upgrades of RPM packages:
 - add the following line to /etc/apt/sources.list if it is not there yet
   (you may also use linuxconf to do this):

 rpm [cncbr] ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates

(replace 6.0 with the correct version number if you are not running CL6.0)

 - run:                 apt-get update
 - after that, execute: apt-get upgrade

 Detailed instructions reagarding the use of apt and upgrade examples 
 can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en


- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at 
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br