SuSE: tcpdump Denial of service vulnerability
Summary
______________________________________________________________________________
SuSE Security Announcement
Package: tcpdump
Announcement-ID: SuSE-SA:2003:0015
Date: Thursday, Mar 13th 2003 16:10 MET
Affected products: 7.3, 8.0, 8.1
SuSE Linux Database Server
SuSE eMail Server 3.1
SuSE eMail Server III
SuSE Firewall Adminhost VPN
SuSE Linux Admin-CD for Firewall
SuSE Firewall on CD 2 - VPN
SuSE Firewall on CD 2
SuSE Linux Live-CD for Firewall
SuSE Linux Connectivity Server
SuSE Linux Enterprise Server 7 for S/390 and zSeries
SuSE Linux Enterprise Server 8
SuSE Linux Office Server
Vulnerability Type: remote system compromise
Severity (1-10): 4
SuSE default package: yes
Cross References: CAN-2003-0108
Content of this advisory:
1) security vulnerability resolved:
- denial-of-service condition while parsing ISAKMP or BGP packets
- possible remote code execution while handling NFS packets
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds:
- ethereal
- qpopper
- XFree4
- sendmail
- apcupsd
- snort
- file
- zlib
- vnc
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
The network traffic analyzer tool tcpdump is vulnerable to a denial-of- service condition while parsing ISAKMP or BGP packets. This bug can
be exploited remotely by an attacker to stop the use of tcpdump for
analyzing network traffic for signs of security breaches or alike.
Another bug may lead to system compromise due to the handling of
malformed NFS packets send by an attacker.
Please note, that tcpdump drops root privileges right after allocating
the needed raw sockets.
There is no temporary fix known.
Please download the update package for your distribution and verify its
integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command "rpm -Fhv file.rpm" to apply
the update.
Our maintenance customers are being notified individually. The packages
are being offered to install from the maintenance web.
Intel i386 Platform:
SuSE-8.1:
524015d3f9517311ee46eb63bc3ed42f
patch rpm(s):
2e1d2db971cf2693e5acca0da7e3bb39
source rpm(s):
12da6755830e7614e8f81a204c546cbf
SuSE-8.0:
069db7de9a137b050f38c6f6a3398266
patch rpm(s):
3dcb00b25d35d275e2e70eba2c96fa26
source rpm(s):
0ed4e0db7d71f5a518173193f8a9b057
SuSE-7.3:
22b2a243e3a2fbbb0288d76da5a2bccc
source rpm(s):
d50729c39c29566371c7d708be782d43
SuSE-7.2:
601bc08d351e8100767bbfd502efd44b
source rpm(s):
af87a4ad56fc853800c6af5982899f18
SuSE-7.1:
a3251d65bfa05948ce3796ac9e5fdf5b
source rpm(s):
84ba69db15e1ff569cf674f7d61428f1
Sparc Platform:
SuSE-7.3:
7f75bdd0c9456fe437647030bb52d92d
source rpm(s):
4b3049a5048e5904a69d16b028220f42
AXP Alpha Platform:
SuSE-7.1:
614dfa16b71456692bc1d92b9db0998b
source rpm(s):
e5a05bdbe3d5a29f0840c488e703268b
PPC Power PC Platform:
SuSE-7.3:
fef9a77ba86c06d661c34646a8101b8a
source rpm(s):
9c800d4fc891a30a4a880b55979ffe3a
SuSE-7.1:
4dd468ba517be7c7f52a8b2ac7c2beb0
source rpm(s):
69be109e360246794c66ed55e199ee95
______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
- ethereal
A format string bug in ethereal's SOCKS handling code and a buffer
overflow in the NTLMSSP was found in ethereal. Both bugs may lead
to remote system compromise.
New packages are currently being build and will be available soon.
- qpopper
In version 4.0.x of qpopper a buffer overflow *after* user authen- tication can be exploited to gain a shell on a POP-server machine.
New packages are currently being build and will be available soon.
- XFree4
A buffer overflow in the Xlib code can be triggered while handling
the environment variable XLOCALEDIR. The X version affected is 4.2.0
(SuSE Linux 8.0 and 8.1).
We still investigate this issue.
- sendmail
A correction is necessary to the last SuSE Security Announcement
(SuSE-SA:2003:013) about sendmail: The Vulnerability Type must read
remote buffer overflow.
- apcupsd
The control and management daemon for APC UPS systems is vulnerable
to remote code execution due to buffer overflow and format string bugs.
A dedicated advisory for this issue will be released as soon as all
packages are build.
- snort
snort, a sensor-based Network Intrusion Detection System, was
vulnerable to a buffer overflow in it's RPC preprocessor.
As a workaround the following line in snort.conf should be commented
out and snort should be restarted to disable the RPC-preprocessor:
preprocessor rpc_decode: 111 32771
Future version of SuSE Linux will be shipped with a fixed snort
package.
- file
A locally exploitable buffer overflow was found in the file command.
New packages are currently being build and will be available soon.
- zlib
zlib's function gzprintf() is prone to a buffer overflow if its
arguments expand to more then Z_PRINTF_BUFSIZE bytes.
A fixed version of zlib will be shipped with future SuSE Linux
versions.
- vnc
VNC (Virtual Network Computing) uses a weak cookie generation process
which can be exploited by an attacker to bypass authentication.
New packages are currently being tested and will be available on our
FTP servers soon.
______________________________________________________________________________
3) standard appendix: authenticity verification, additional information
- Package authenticity verification:
SuSE update packages are available on many mirror ftp servers all over
the world. While this service is being considered valuable and important
to the free and open source software community, many users wish to be
sure about the origin of the package and its content before installing
the package. There are two verification methods that can be used
independently from each other to prove the authenticity of a downloaded
file or rpm package:
1) md5sums as provided in the (cryptographically signed) announcement.
2) using the internal gpg signatures of the rpm package.
1) execute the command
md5sum
References
