Home > Security > Advisories

Advisories

Mandriva Advisories

Package name tcpdump
Date May 16th, 2002
Advisory ID MDKSA-2002:032
Affected versions 7.1, 7.2, 8.0, 8.1, 8.2, CS1.0
Synopsis Updated tcpdump packages fix buffer overflows

Problem Description

Several buffer overflows were found in the tcpdump package by FreeBSD
developers during a code audit, in versions prior to 3.5. However,
newer versions of tcpdump, including 3.6.2, are also vulnerable to
another buffer overflow in the AFS RPC decoding functions, which was
discovered by Nick Cleaton. These vulnerabilities could be used by
a remote attacker to crash the the tcpdump process or possibly even
be exploited to execute arbitrary code as the user running tcpdump,
which is usually root.

The newer libpcap 0.6 has also been audited to make it more safe by
implementing better buffer boundary checks in several functions.

Updated Packages

Mandrakelinux 7.1

 a17ec464d576bdbd870dc6a5d25fc59d  7.1/RPMS/libpcap-0.6.2-3.2mdk.i586.rpm
ed780612ab8620e84e8310432a5df0b9  7.1/RPMS/libpcap-devel-0.6.2-3.2mdk.i586.rpm
a186519910760e36b7e50456412ab20e  7.1/RPMS/tcpdump-3.6.2-2.2mdk.i586.rpm
5e6091d2f916b180ffc80d60e2005a49  7.1/SRPMS/libpcap-0.6.2-3.2mdk.src.rpm
a997724147a333e27e72670bff28e5ee  7.1/SRPMS/tcpdump-3.6.2-2.2mdk.src.rpm

Mandrakelinux 7.2

 e39a58560c3ec60a574c63dd9e383fda  7.2/RPMS/libpcap-0.6.2-3.2mdk.i586.rpm
4600b4d1a435d17a77560a36e28ddc70  7.2/RPMS/libpcap-devel-0.6.2-3.2mdk.i586.rpm
fc014253b27e44c8a230f936d7eadf9e  7.2/RPMS/tcpdump-3.6.2-2.2mdk.i586.rpm
5e6091d2f916b180ffc80d60e2005a49  7.2/SRPMS/libpcap-0.6.2-3.2mdk.src.rpm
a997724147a333e27e72670bff28e5ee  7.2/SRPMS/tcpdump-3.6.2-2.2mdk.src.rpm

Mandrakelinux 8.0

 d8deeabab302271054ecad942a14013e  8.0/RPMS/libpcap0-0.6.2-3.1mdk.i586.rpm
b2aa6d27578b8699640b6ed2e76ba228  8.0/RPMS/libpcap0-devel-0.6.2-3.1mdk.i586.rpm
16eac5435d8b8e1075c10d393a2914a5  8.0/RPMS/tcpdump-3.6.2-2.1mdk.i586.rpm
4b1956a781b1185e693a26037d4804a5  8.0/SRPMS/libpcap-0.6.2-3.1mdk.src.rpm
683c3b6f0ae7754090cbcf480cd731b0  8.0/SRPMS/tcpdump-3.6.2-2.1mdk.src.rpm

Mandrakelinux 8.0/PPC

 4a4f5cca7fc50d1616b857b89afe3ae3  ppc/8.0/RPMS/libpcap0-0.6.2-3.1mdk.ppc.rpm
11be44f15a54a9654cd48b5b8aed04ba  ppc/8.0/RPMS/libpcap0-devel-0.6.2-3.1mdk.ppc.rpm
68255f8f80d88b91fd488d6379db81df  ppc/8.0/RPMS/tcpdump-3.6.2-2.1mdk.ppc.rpm
4b1956a781b1185e693a26037d4804a5  ppc/8.0/SRPMS/libpcap-0.6.2-3.1mdk.src.rpm
683c3b6f0ae7754090cbcf480cd731b0  ppc/8.0/SRPMS/tcpdump-3.6.2-2.1mdk.src.rpm

Mandrakelinux 8.1

 39715d1c613144e859f0386ee583377a  8.1/RPMS/tcpdump-3.6.2-2.1mdk.i586.rpm
683c3b6f0ae7754090cbcf480cd731b0  8.1/SRPMS/tcpdump-3.6.2-2.1mdk.src.rpm

Mandrakelinux 8.1/IA64

 6331901e596e243099aa6474481ea88a  ia64/8.1/RPMS/tcpdump-3.6.2-2.1mdk.ia64.rpm
683c3b6f0ae7754090cbcf480cd731b0  ia64/8.1/SRPMS/tcpdump-3.6.2-2.1mdk.src.rpm

Mandrakelinux 8.2

 8c36a78c9a086c2d582d70d431533650  8.2/RPMS/tcpdump-3.6.2-2.1mdk.i586.rpm
683c3b6f0ae7754090cbcf480cd731b0  8.2/SRPMS/tcpdump-3.6.2-2.1mdk.src.rpm

Mandrakelinux 8.2/PPC

 081041c2713a9c76c5bf2fc727a03c45  ppc/8.2/RPMS/tcpdump-3.6.2-2.1mdk.ppc.rpm
683c3b6f0ae7754090cbcf480cd731b0  ppc/8.2/SRPMS/tcpdump-3.6.2-2.1mdk.src.rpm

Corporate Server 1.0.1

 a17ec464d576bdbd870dc6a5d25fc59d  1.0.1/RPMS/libpcap-0.6.2-3.2mdk.i586.rpm
ed780612ab8620e84e8310432a5df0b9  1.0.1/RPMS/libpcap-devel-0.6.2-3.2mdk.i586.rpm
a186519910760e36b7e50456412ab20e  1.0.1/RPMS/tcpdump-3.6.2-2.2mdk.i586.rpm
5e6091d2f916b180ffc80d60e2005a49  1.0.1/SRPMS/libpcap-0.6.2-3.2mdk.src.rpm
a997724147a333e27e72670bff28e5ee  1.0.1/SRPMS/tcpdump-3.6.2-2.2mdk.src.rpm

References

http://www.ciac.org/ciac/bulletins/l-015.shtml
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:48.tcpdump.asc

Upgrade

To upgrade automatically, use MandrivaUpdate.


Verification

Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :

                rpm --checksig package.rpm

You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.

If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.