OpenPKG Security Advisory

Publisher Name:          OpenPKG GmbH
Publisher Home:          http://openpkg.com/

Advisory Id (public):    OpenPKG-SA-2003.014
Advisory Type:           OpenPKG Security Advisory (SA)
Advisory Directory:      http://openpkg.com/go/OpenPKG-SA
Advisory Document:       http://openpkg.com/go/OpenPKG-SA-2003.014
Advisory Published:      2010-09-03 23:37 UTC

Issue Id (internal):     OpenPKG-SI-20030304.01
Issue First Created:     2003-03-04
Issue Last Modified:     2006-11-28
Issue Revision:          05


Subject Name:            tcpdump
Subject Summary:         Network Packet Dumping Tool
Subject Home:            http://www.tcpdump.org/
Subject Versions:        * <= 3.7.1

Vulnerability Id:        CVE-2003-0108
Vulnerability Scope:     global (not OpenPKG specific)

Attack Feasibility:      run-time
Attack Vector:           remote network
Attack Impact:           denial of service

Description:
    Andrew Griffiths and iDEFENSE Labs discovered [1] a vulnerability in
    tcpdump [0] which can result in a Denial of Service (DoS) attack due
    to an endless processing loop consuming CPU resources when parsing
    malformed ISAKMP packets (UDP, port 500).
    
    Similarily, another DoS attack is possible because tcpdump enters
    also an endless processing loop consuming CPU resources when parsing
    malformed BGP packets (TCP, port 179). Finally, a buffer overflow is
    possible when parsing malformed NFS packets (UDP, port 2049).

References:
    [0] http://www.tcpdump.org/
    [1] http://www.idefense.com/advisory/02.27.03.txt
    [2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0108
    [3] http://www.openpkg.org/tutorial.html#regular-source
    [4] http://www.openpkg.org/tutorial.html#regular-binary
    [5] ftp://ftp.openpkg.org/release/1.1/UPD/tcpdump-3.7.1-1.1.1.src.rpm
    [6] ftp://ftp.openpkg.org/release/1.2/UPD/tcpdump-3.7.1-1.2.1.src.rpm
    [7] ftp://ftp.openpkg.org/release/1.1/UPD/
    [8] ftp://ftp.openpkg.org/release/1.2/UPD/
    [9] http://www.openpkg.org/security.html#signature


Primary Package Name:    tcpdump
Primary Package Home:    http://openpkg.org/go/package/tcpdump

Affected Distribution:   Affected Branch:  Affected Package:
OpenPKG Community        1.1-SOLID         tcpdump-3.7.1-1.1.0
OpenPKG Community        1.2-SOLID         tcpdump-3.7.1-1.2.0
OpenPKG Community        CURRENT           tcpdump-3.7.1-20020822

Corrected Distribution:  Corrected Branch: Corrected Package:
OpenPKG Community        1.1-SOLID         tcpdump-3.7.1-1.1.1
OpenPKG Community        1.2-SOLID         tcpdump-3.7.1-1.2.1
OpenPKG Community        CURRENT           tcpdump-3.7.2-20030227