-----BEGIN PGP SIGNED MESSAGE-----
=============================================================================
FreeBSD-SA-01:48 Security Advisory
FreeBSD, Inc.
Topic: tcpdump contains remote buffer overflow
Category: core
Module: tcpdump
Announced: 2001-07-17
Credits: Nick Cleaton <nickat_private>
Affects: All releases of FreeBSD 4.x prior to 4.4,
FreeBSD 4.3-STABLE prior to the correction date
FreeBSD 3.x is unaffected.
Corrected: 2001-07-09
Vendor status: Patch released
FreeBSD only: NO
I. Background
tcpdump is a tool for monitoring network traffic activity.
II. Problem Description
An overflowable buffer was found in the version of tcpdump included
with FreeBSD 4.x. Due to incorrect string length handling in the
decoding of AFS RPC packets, a remote user may be able to overflow a
buffer causing the local tcpdump process to crash. In addition, it
may be possible to execute arbitrary code with the privileges of the
user running tcpdump, often root.
The effects of this vulnerability are similiar to those described in
advisory FreeBSD-SA-00:61.tcpdump.v1.1.
All released versions of FreeBSD prior to the correction date
including 4.3-RELEASE are vulnerable to this problem, however it does
not affect the FreeBSD 3.x branch which includes an older version of
tcpdump.
III. Impact
Remote users can cause the local tcpdump process to crash, and may be
able to cause arbitrary code to be executed as the user running
tcpdump, often root.
IV. Workaround
Do not use vulnerable versions of tcpdump in network environments
which may contain packets from untrusted sources.
V. Solution
One of the following:
1) Upgrade your vulnerable FreeBSD system to 4.3-STABLE or the
RELENG_4_3 security branch after the respective correction dates.
2) FreeBSD 4.x systems prior to the correction date:
Download the patch and the detached PGP signature from the following
locations, and verify the signature using your PGP utility.
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:48/tcpdump-4.x.patch
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:48/tcpdump-4.x.patch.asc
# cd /usr/src/contrib/tcpdump
# patch -p < /path/to/patch
# cd /usr/src/usr.sbin/tcpdump
# make depend && make all install
3) FreeBSD 4.3-RELEASE systems:
An experimental upgrade package is available for users who wish to
provide testing and feedback on the binary upgrade process. This
package may be installed on FreeBSD 4.3-RELEASE systems only, and is
intended for use on systems for which source patching is not practical
or convenient.
If you use the upgrade package, feedback (positive or negative) is
requested to security-officerat_private so we can improve the
process for future advisories.
During the installation procedure, backup copies are made of the files
which are replaced by the package. These backup copies will be
reinstalled if the package is removed, reverting the system to a
pre-patched state.
Two versions of the upgrade package are available, depending on
whether or not the system has openssl installed. To verify whether
your system has openssl installed, perform the following command:
# ls /usr/bin/openssl
Possible responses:
/usr/bin/openssl # This response indicates you have openssl present
ls: /usr/bin/openssl: No such file or directory
# This reponse indicates you do not have
# openssl present
3a) If OpenSSL is not present
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/packages/SA-01:48/security-patch-tcpdump-nossl-01.48.tgz
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/packages/SA-01:48/security-patch-tcpdump-nossl-01.48.tgz.asc
Verify the detached PGP signature using your PGP utility.
# pkg_add security-patch-tcpdump-nossl-01.48.tgz
3b) If OpenSSL is present
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/packages/SA-01:48/security-patch-tcpdump-ssl-01.48.tgz
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/packages/SA-01:48/security-patch-tcpdump-ssl-01.48.tgz.asc
Verify the detached PGP signature using your PGP utility.
# pkg_add security-patch-tcpdump-ssl-01.48.tgz
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org
iQCVAwUBO1R5i1UuHi5z0oilAQFdCQQAhFUzYA7plZN1O0rK/iU/jPaoCqM0KDPP
Vdg+3zP8I5Vovdbxdns1DVefI3PVhZbLwh8E0ZnEz544FB5atiYsRiqQxuoEMZiN
1JSRHUOIYyAChtIUZY1JV9eF8GfemWaAcgNp7mNWYKl7dUn0nYERfTO92YNm+l7M
3nNvOwkhqLU=
=PrXC
-----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Wed Jul 18 2001 - 12:13:52 PDT