Tcpdump Can Be Crashed By a Remote User Sending a Malicious ISAKMP Packet
|
|
SecurityTracker Alert ID: 1008716
|
|
SecurityTracker URL: http://securitytracker.com/id?1008716
|
|
CVE Reference: CAN-2003-0989
, CAN-2004-0057
(Links to External Site)
|
Updated: Jan 16 2004
|
Original Entry Date: Jan 14 2004
|
Impact: Denial of service via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 3.8.1 and prior versions
|
Description: Several vulnerabilities were reported in tcpdump in the processing of ISAKMP packets. A remote user can cause tcmpdump to crash or to enter an infinite loop.
It is reported that the rawprint() function in print-isakmp.c fails to validate its input arguments [CVE: CAN-2004-0057]. A remote
user can send a specially crafted ISAKMP packet to cause the tcpdump process to crash. Red Hat credits Jonathan Heusser with discovering
this flaw. Version 3.8.1 and prior versions are affected.
It is also reported that versions prior to 3.8.1 contain flaws that
allow a remote user to force tcpdump to enter an infinite loop [CVE: CAN-2003-0989]. According to Red Hat, George Bakos discovered
these flaws.
|
Impact: A remote user can cause the tcpdump process to crash or to enter an endless loop.
|
Solution: The vendor has issued a fix, available via CVS.
|
Vendor URL: cvs.tcpdump.org/cgi-bin/cvsweb/tcpdump/print-isakmp.c (Links to External Site)
|
Cause: Boundary error, Input validation error, State error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Wed, 14 Jan 2004 10:27:14 -0500
Subject: CAN-2003-0989
|
http://cvs.tcpdump.org/cgi-bin/cvsweb/tcpdump/print-isakmp.c
> 1.36.2.6 Wed Jan 7 7:53:17 2004 by hannes
> Branch: tcpdump_3_8
> bugfix from Jonathan Heusser <jonny@drugphish.ch>
>
> The first critical piece of code is found in print-isakmp.c:332. The
> function rawprint() does not check its arguments thus it's easy for
> an attacker to pass a big 'len' or a bogus 'loc' leading to a
> segmentation fault in the for loop.
Also, SuSE reports:
> There is a bug in the tcpdump code responsible for handling ISAKMP
> messages. This bug allows remote attackers to destroy a current
> tcpdump session by tricking the tcpdump program with evil ISAKMP
> messages to enter an endless loop.
CAN-2003-0989
|
|
