It was discovered that certain invalid GRE, LDP, BGP, and RSVP packets triggered infinite loops in tcpdump, which caused tcpdump to stop working. This could be abused by a remote attacker to bypass tcpdump analysis of network traffic.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A number of Denial of Service vulnerabilities were discovered in the way that tcpdump processes certain network packets. If abused, these flaws can allow a remote attacker to inject a carefully crafted packet onto the network, crashing tcpdump.

The provided packages have been patched to correct these issues.

Problem Description Several tcpdump protocol decoders contain programming errors which can cause them to go into infinite loops.
Impact An attacker can inject specially crafted packets into the network which, when processed by tcpdump, could lead to a denial-of-service. After the attack, tcpdump would no longer capture traffic, and would potentially use all available processor time.

The remote host is affected by the vulnerability described in GLSA-200505-06 (TCPDump: Decoding routines Denial of Service vulnerability)

    TCPDump improperly handles and decodes ISIS (CAN-2005-1278), BGP     (CAN-2005-1267, CAN-2005-1279), LDP (CAN-2005-1279) and RSVP     (CAN-2005-1280) packets. TCPDump might loop endlessly after receiving     malformed packets.
  Impact :

    A malicious remote attacker can exploit the decoding issues for a     Denial of Service attack by sending specially crafted packets, possibly     causing TCPDump to loop endlessly.
  Workaround :

    There is no known workaround at this time.

Updated tcpdump packages that fix several security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

These updated packages also add support for output files larger than 2 GB, add support for some new VLAN IDs, and fix message parsing on 64bit architectures.

Tcpdump is a command-line tool for monitoring network traffic.

Several denial of service bugs were found in the way tcpdump processes certain network packets. It is possible for an attacker to inject a carefully crafted packet onto the network, crashing a running tcpdump session. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-1278, CVE-2005-1279, and CVE-2005-1280 to these issues.

Additionally, the tcpdump utility can now write a file larger than 2 GB, parse some new VLAN IDs, and parse messages on 64bit architectures.

Users of tcpdump are advised to upgrade to these erratum packages, which contain backported security patches and are not vulnerable to these issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:417 advisory.

  - security flaw (CVE-2005-1278, CVE-2005-1279, CVE-2005-1280)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated tcpdump packages that fix several security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

This updated package also adds support for output files larger than 2 GB.

Tcpdump is a command-line tool for monitoring network traffic.

Several denial of service bugs were found in the way tcpdump processes certain network packets. It is possible for an attacker to inject a carefully crafted packet onto the network, crashing a running tcpdump session. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-1278, CVE-2005-1279, and CVE-2005-1280 to these issues.

The tcpdump utility can now write a file larger than 2 GB.

Users of tcpdump are advised to upgrade to these erratum packages, which contain backported security patches and are not vulnerable to these issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
20507	Ubuntu 4.10 / 5.04 : tcpdump vulnerabilities (USN-119-1)	Nessus	Ubuntu Local Security Checks	2006/1/15	2021/1/19	medium
18276	Mandrake Linux Security Advisory : tcpdump (MDKSA-2005:087)	Nessus	Mandriva Local Security Checks	2005/5/17	2021/1/6	medium
19052	FreeBSD : tcpdump -- infinite loops in protocol decoding (9fae0f1f-df82-11d9-b875-0001020eed82)	Nessus	FreeBSD Local Security Checks	2005/7/13	2021/1/6	medium
18232	GLSA-200505-06 : TCPDump: Decoding routines Denial of Service vulnerability	Nessus	Gentoo Local Security Checks	2005/5/11	2021/1/6	medium
18239	RHEL 3 : tcpdump (RHSA-2005:421)	Nessus	Red Hat Local Security Checks	2005/5/11	2021/1/14	medium
18238	RHEL 4 : tcpdump (RHSA-2005:417)	Nessus	Red Hat Local Security Checks	2005/5/11	2024/4/27	high
21823	CentOS 3 : tcpdump (CESA-2005:421)	Nessus	CentOS Local Security Checks	2006/7/3	2021/1/4	medium
21936	CentOS 3 / 4 : tcpdump (CESA-2005:417)	Nessus	CentOS Local Security Checks	2006/7/5	2021/1/4	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

high

medium

medium