From bugzilla@redhat.com Thu May 30 14:34:27 2002 From: bugzilla@redhat.com To: redhat-watch-list@redhat.com Cc: bugtraq@securityfocus.com, linux-security@redhat.com Date: Thu, 30 May 2002 08:52 -0400 Subject: [RHSA-2002:094-08] Updated tcpdump packages fix buffer overflow [The following text is in the "iso-8859-1" character set] [Your display is set for the "US-ASCII" character set] [Some characters may be displayed incorrectly] --------------------------------------------------------------------- Red Hat, Inc. Red Hat Security Advisory Synopsis: Updated tcpdump packages fix buffer overflow Advisory ID: RHSA-2002:094-08 Issue date: 2002-05-17 Updated on: 2002-05-29 Product: Red Hat Linux Keywords: tcpdump arpwatch buffer overflow Cross references: Obsoletes: RHSA-2001:089-10 CVE Names: CAN-2002-0380 --------------------------------------------------------------------- 1. Topic: Updated tcpdump, libpcap, and arpwatch packages are available for Red Hat Linux 6.2 and 7.x. These updates close a buffer overflow when handling NFS packets. 2. Relevant releases/architectures: Red Hat Linux 6.2 - alpha, i386, sparc Red Hat Linux 7.0 - alpha, i386 Red Hat Linux 7.1 - alpha, i386, ia64 Red Hat Linux 7.2 - i386, ia64, s390 3. Problem description: tcpdump is a command-line tool for monitoring network traffic. Versions of tcpdump up to and including 3.6.2 have a buffer overflow that can be triggered when tracing the network by a bad NFS packet. We are not yet aware if this issue is fully exploitable; however, users of tcpdump are advised to upgrade to these errata packages which contain a patch for this issue. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-0380 to this issue. This issue was found by David Woodhouse of Red Hat. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info): 55145 - tcpdump segfaults when displaying NFS traffic. 63113 - Start script refers to non/existing /etc/init.d directory 6. RPMs required: Red Hat Linux 6.2: SRPMS: ftp://updates.redhat.com/6.2/en/os/SRPMS/tcpdump-3.6.2-11.6.2.0.src.rpm alpha: ftp://updates.redhat.com/6.2/en/os/alpha/tcpdump-3.6.2-11.6.2.0.alpha.rpm ftp://updates.redhat.com/6.2/en/os/alpha/libpcap-0.6.2-11.6.2.0.alpha.rpm ftp://updates.redhat.com/6.2/en/os/alpha/arpwatch-2.1a11-11.6.2.0.alpha.rpm i386: ftp://updates.redhat.com/6.2/en/os/i386/tcpdump-3.6.2-11.6.2.0.i386.rpm ftp://updates.redhat.com/6.2/en/os/i386/libpcap-0.6.2-11.6.2.0.i386.rpm ftp://updates.redhat.com/6.2/en/os/i386/arpwatch-2.1a11-11.6.2.0.i386.rpm sparc: ftp://updates.redhat.com/6.2/en/os/sparc/tcpdump-3.6.2-11.6.2.0.sparc.rpm ftp://updates.redhat.com/6.2/en/os/sparc/libpcap-0.6.2-11.6.2.0.sparc.rpm ftp://updates.redhat.com/6.2/en/os/sparc/arpwatch-2.1a11-11.6.2.0.sparc.rpm Red Hat Linux 7.0: SRPMS: ftp://updates.redhat.com/7.0/en/os/SRPMS/tcpdump-3.6.2-11.7.0.0.src.rpm alpha: ftp://updates.redhat.com/7.0/en/os/alpha/tcpdump-3.6.2-11.7.0.0.alpha.rpm ftp://updates.redhat.com/7.0/en/os/alpha/libpcap-0.6.2-11.7.0.0.alpha.rpm ftp://updates.redhat.com/7.0/en/os/alpha/arpwatch-2.1a11-11.7.0.0.alpha.rpm i386: ftp://updates.redhat.com/7.0/en/os/i386/tcpdump-3.6.2-11.7.0.0.i386.rpm ftp://updates.redhat.com/7.0/en/os/i386/libpcap-0.6.2-11.7.0.0.i386.rpm ftp://updates.redhat.com/7.0/en/os/i386/arpwatch-2.1a11-11.7.0.0.i386.rpm Red Hat Linux 7.1: SRPMS: ftp://updates.redhat.com/7.1/en/os/SRPMS/tcpdump-3.6.2-11.7.1.0.src.rpm alpha: ftp://updates.redhat.com/7.1/en/os/alpha/tcpdump-3.6.2-11.7.1.0.alpha.rpm ftp://updates.redhat.com/7.1/en/os/alpha/libpcap-0.6.2-11.7.1.0.alpha.rpm ftp://updates.redhat.com/7.1/en/os/alpha/arpwatch-2.1a11-11.7.1.0.alpha.rpm i386: ftp://updates.redhat.com/7.1/en/os/i386/tcpdump-3.6.2-11.7.1.0.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/libpcap-0.6.2-11.7.1.0.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/arpwatch-2.1a11-11.7.1.0.i386.rpm ia64: ftp://updates.redhat.com/7.1/en/os/ia64/tcpdump-3.6.2-11.7.1.0.ia64.rpm ftp://updates.redhat.com/7.1/en/os/ia64/libpcap-0.6.2-11.7.1.0.ia64.rpm ftp://updates.redhat.com/7.1/en/os/ia64/arpwatch-2.1a11-11.7.1.0.ia64.rpm Red Hat Linux 7.2: SRPMS: ftp://updates.redhat.com/7.2/en/os/SRPMS/tcpdump-3.6.2-11.7.2.0.src.rpm i386: ftp://updates.redhat.com/7.2/en/os/i386/tcpdump-3.6.2-11.7.2.0.i386.rpm ftp://updates.redhat.com/7.2/en/os/i386/libpcap-0.6.2-11.7.2.0.i386.rpm ftp://updates.redhat.com/7.2/en/os/i386/arpwatch-2.1a11-11.7.2.0.i386.rpm ia64: ftp://updates.redhat.com/7.2/en/os/ia64/tcpdump-3.6.2-11.7.2.0.ia64.rpm ftp://updates.redhat.com/7.2/en/os/ia64/libpcap-0.6.2-11.7.2.0.ia64.rpm ftp://updates.redhat.com/7.2/en/os/ia64/arpwatch-2.1a11-11.7.2.0.ia64.rpm 7. Verification: MD5 sum Package Name -------------------------------------------------------------------------- d31951e4a06b8c08c1e39abfd0b13955 6.2/en/os/SRPMS/tcpdump-3.6.2-11.6.2.0.src.rpm b06ccff8c19676918f60bf2708daf1ad 6.2/en/os/alpha/arpwatch-2.1a11-11.6.2.0.alpha.rpm 4da963c19df79272f2f97c219206a04e 6.2/en/os/alpha/libpcap-0.6.2-11.6.2.0.alpha.rpm bb5ca0570255798bcccf651e4169f45c 6.2/en/os/alpha/tcpdump-3.6.2-11.6.2.0.alpha.rpm 47a2bf8d8534d8e70530d9c394da8f92 6.2/en/os/i386/arpwatch-2.1a11-11.6.2.0.i386.rpm 05b1442e28f961440c4345e5a7f9d4d8 6.2/en/os/i386/libpcap-0.6.2-11.6.2.0.i386.rpm f617a999adeff7a71b557eef6a6271a9 6.2/en/os/i386/tcpdump-3.6.2-11.6.2.0.i386.rpm 629b18c6f91d21a2b503d05349e331a0 6.2/en/os/sparc/arpwatch-2.1a11-11.6.2.0.sparc.rpm b0f50ae9d447bbe40c411cc4c66215a3 6.2/en/os/sparc/libpcap-0.6.2-11.6.2.0.sparc.rpm e9317d5b6b2c473a44c6fed9ec7c25fc 6.2/en/os/sparc/tcpdump-3.6.2-11.6.2.0.sparc.rpm b1abeb15f7a85fb77827e848737c9949 7.0/en/os/SRPMS/tcpdump-3.6.2-11.7.0.0.src.rpm 75f65e70953953b346359967a89a1980 7.0/en/os/alpha/arpwatch-2.1a11-11.7.0.0.alpha.rpm 3418be3679d89faa81a0732dba448897 7.0/en/os/alpha/libpcap-0.6.2-11.7.0.0.alpha.rpm 659f8cb30777c5022c52a54d96baca54 7.0/en/os/alpha/tcpdump-3.6.2-11.7.0.0.alpha.rpm 098c900c75d194402fade5528b2263ca 7.0/en/os/i386/arpwatch-2.1a11-11.7.0.0.i386.rpm 186da1899fea780a15501354de5d6715 7.0/en/os/i386/libpcap-0.6.2-11.7.0.0.i386.rpm db064ed0c0b16986b92e97bf2492c945 7.0/en/os/i386/tcpdump-3.6.2-11.7.0.0.i386.rpm 27bf8dea340db81f1e946356c6bef684 7.1/en/os/SRPMS/tcpdump-3.6.2-11.7.1.0.src.rpm a677cec9114214c2ea5e5b17e709883d 7.1/en/os/alpha/arpwatch-2.1a11-11.7.1.0.alpha.rpm f7b8cf962abe27d65d628dae5cb992bd 7.1/en/os/alpha/libpcap-0.6.2-11.7.1.0.alpha.rpm 755e2fa9fb0530735e03388f702cfd38 7.1/en/os/alpha/tcpdump-3.6.2-11.7.1.0.alpha.rpm edc6718ed479661f40c929da92b4e24b 7.1/en/os/i386/arpwatch-2.1a11-11.7.1.0.i386.rpm 4e1a186b4287de4183a7fca4d868906e 7.1/en/os/i386/libpcap-0.6.2-11.7.1.0.i386.rpm 2eb63c329def52d1bcdd88f8b3d01841 7.1/en/os/i386/tcpdump-3.6.2-11.7.1.0.i386.rpm 17319e98b00c707f8c924766f0395aad 7.1/en/os/ia64/arpwatch-2.1a11-11.7.1.0.ia64.rpm 8a214b04f325451eecaf08574ebacc7a 7.1/en/os/ia64/libpcap-0.6.2-11.7.1.0.ia64.rpm 90db41ce76a94d2d10369437704bb934 7.1/en/os/ia64/tcpdump-3.6.2-11.7.1.0.ia64.rpm 1cfcf4efdad9c8d44f9c70a9da8da690 7.2/en/os/SRPMS/tcpdump-3.6.2-11.7.2.0.src.rpm 82f93afd069a3b85ddf5a44daeff589f 7.2/en/os/i386/arpwatch-2.1a11-11.7.2.0.i386.rpm f26ebb5d1cbb91d4b5effd9174f1728d 7.2/en/os/i386/libpcap-0.6.2-11.7.2.0.i386.rpm cc168b456fbde106ad1879fe7346c1ee 7.2/en/os/i386/tcpdump-3.6.2-11.7.2.0.i386.rpm 74863a3b3110d2dbb03a03c1ad213152 7.2/en/os/ia64/arpwatch-2.1a11-11.7.2.0.ia64.rpm 876adc0c4d794e75a48e5c6b87fbca45 7.2/en/os/ia64/libpcap-0.6.2-11.7.2.0.ia64.rpm f7543f13b1734c779cafd600566569b2 7.2/en/os/ia64/tcpdump-3.6.2-11.7.2.0.ia64.rpm These packages are GPG signed by Red Hat, Inc. for security. Our key is available at: http://www.redhat.com/about/contact/pgpkey.html You can verify each package with the following command: rpm --checksig If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nogpg 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0380 Copyright(c) 2000, 2001, 2002 Red Hat, Inc.