SuSE Security Announcement: tcpdump (SuSE-SA:2003:0015)
-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SuSE Security Announcement
Package: tcpdump
Announcement-ID: SuSE-SA:2003:0015
Date: Thursday, Mar 13th 2003 16:10 MET
Affected products: 7.3, 8.0, 8.1
SuSE Linux Database Server
SuSE eMail Server 3.1
SuSE eMail Server III
SuSE Firewall Adminhost VPN
SuSE Linux Admin-CD for Firewall
SuSE Firewall on CD 2 - VPN
SuSE Firewall on CD 2
SuSE Linux Live-CD for Firewall
SuSE Linux Connectivity Server
SuSE Linux Enterprise Server 7 for S/390 and zSeries
SuSE Linux Enterprise Server 8
SuSE Linux Office Server
Vulnerability Type: remote system compromise
Severity (1-10): 4
SuSE default package: yes
Cross References: CAN-2003-0108
Content of this advisory:
1) security vulnerability resolved:
- denial-of-service condition while parsing ISAKMP or BGP packets
- possible remote code execution while handling NFS packets
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds:
- ethereal
- qpopper
- XFree4
- sendmail
- apcupsd
- snort
- file
- zlib
- vnc
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
The network traffic analyzer tool tcpdump is vulnerable to a denial-of-
service condition while parsing ISAKMP or BGP packets. This bug can
be exploited remotely by an attacker to stop the use of tcpdump for
analyzing network traffic for signs of security breaches or alike.
Another bug may lead to system compromise due to the handling of
malformed NFS packets send by an attacker.
Please note, that tcpdump drops root privileges right after allocating
the needed raw sockets.
There is no temporary fix known.
Please download the update package for your distribution and verify its
integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command "rpm -Fhv file.rpm" to apply
the update.
Our maintenance customers are being notified individually. The packages
are being offered to install from the maintenance web.
Intel i386 Platform:
SuSE-8.1:
ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/tcpdump-3.7.1-198.i586.rpm
524015d3f9517311ee46eb63bc3ed42f
patch rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/tcpdump-3.7.1-198.i586.patch.rpm
2e1d2db971cf2693e5acca0da7e3bb39
source rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/src/tcpdump-3.7.1-198.src.rpm
12da6755830e7614e8f81a204c546cbf
SuSE-8.0:
ftp://ftp.suse.com/pub/suse/i386/update/8.0/n1/tcpdump-3.6.2-322.i386.rpm
069db7de9a137b050f38c6f6a3398266
patch rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/8.0/n1/tcpdump-3.6.2-322.i386.patch.rpm
3dcb00b25d35d275e2e70eba2c96fa26
source rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/tcpdump-3.6.2-322.src.rpm
0ed4e0db7d71f5a518173193f8a9b057
SuSE-7.3:
ftp://ftp.suse.com/pub/suse/i386/update/7.3/n1/tcpdump-3.6.2-321.i386.rpm
22b2a243e3a2fbbb0288d76da5a2bccc
source rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/tcpdump-3.6.2-321.src.rpm
d50729c39c29566371c7d708be782d43
SuSE-7.2:
ftp://ftp.suse.com/pub/suse/i386/update/7.2/n1/tcpdump-3.4a6-376.i386.rpm
601bc08d351e8100767bbfd502efd44b
source rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/tcpdump-3.4a6-376.src.rpm
af87a4ad56fc853800c6af5982899f18
SuSE-7.1:
ftp://ftp.suse.com/pub/suse/i386/update/7.1/n1/tcpdump-3.4a6-375.i386.rpm
a3251d65bfa05948ce3796ac9e5fdf5b
source rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/tcpdump-3.4a6-375.src.rpm
84ba69db15e1ff569cf674f7d61428f1
Sparc Platform:
SuSE-7.3:
ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n1/tcpdump-3.6.2-65.sparc.rpm
7f75bdd0c9456fe437647030bb52d92d
source rpm(s):
ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/tcpdump-3.6.2-65.src.rpm
4b3049a5048e5904a69d16b028220f42
AXP Alpha Platform:
SuSE-7.1:
ftp://ftp.suse.com/pub/suse/axp/update/7.1/n1/tcpdump-3.4a6-329.alpha.rpm
614dfa16b71456692bc1d92b9db0998b
source rpm(s):
ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/tcpdump-3.4a6-329.src.rpm
e5a05bdbe3d5a29f0840c488e703268b
PPC Power PC Platform:
SuSE-7.3:
ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n1/tcpdump-3.6.2-207.ppc.rpm
fef9a77ba86c06d661c34646a8101b8a
source rpm(s):
ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/tcpdump-3.6.2-207.src.rpm
9c800d4fc891a30a4a880b55979ffe3a
SuSE-7.1:
ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n1/tcpdump-3.4a6-317.ppc.rpm
4dd468ba517be7c7f52a8b2ac7c2beb0
source rpm(s):
ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/tcpdump-3.4a6-317.src.rpm
69be109e360246794c66ed55e199ee95
______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
- ethereal
A format string bug in ethereal's SOCKS handling code and a buffer
overflow in the NTLMSSP was found in ethereal. Both bugs may lead
to remote system compromise.
New packages are currently being build and will be available soon.
- qpopper
In version 4.0.x of qpopper a buffer overflow *after* user authen-
tication can be exploited to gain a shell on a POP-server machine.
New packages are currently being build and will be available soon.
- XFree4
A buffer overflow in the Xlib code can be triggered while handling
the environment variable XLOCALEDIR. The X version affected is 4.2.0
(SuSE Linux 8.0 and 8.1).
We still investigate this issue.
- sendmail
A correction is necessary to the last SuSE Security Announcement
(SuSE-SA:2003:013) about sendmail: The Vulnerability Type must read
remote buffer overflow.
- apcupsd
The control and management daemon for APC UPS systems is vulnerable
to remote code execution due to buffer overflow and format string bugs.
A dedicated advisory for this issue will be released as soon as all
packages are build.
- snort
snort, a sensor-based Network Intrusion Detection System, was
vulnerable to a buffer overflow in it's RPC preprocessor.
As a workaround the following line in snort.conf should be commented
out and snort should be restarted to disable the RPC-preprocessor:
preprocessor rpc_decode: 111 32771
Future version of SuSE Linux will be shipped with a fixed snort
package.
- file
A locally exploitable buffer overflow was found in the file command.
New packages are currently being build and will be available soon.
- zlib
zlib's function gzprintf() is prone to a buffer overflow if its
arguments expand to more then Z_PRINTF_BUFSIZE bytes.
A fixed version of zlib will be shipped with future SuSE Linux
versions.
- vnc
VNC (Virtual Network Computing) uses a weak cookie generation process
which can be exploited by an attacker to bypass authentication.
New packages are currently being tested and will be available on our
FTP servers soon.
______________________________________________________________________________
3) standard appendix: authenticity verification, additional information
- Package authenticity verification:
SuSE update packages are available on many mirror ftp servers all over
the world. While this service is being considered valuable and important
to the free and open source software community, many users wish to be
sure about the origin of the package and its content before installing
the package. There are two verification methods that can be used
independently from each other to prove the authenticity of a downloaded
file or rpm package:
1) md5sums as provided in the (cryptographically signed) announcement.
2) using the internal gpg signatures of the rpm package.
1) execute the command
md5sum
Hello, I did a online update of a SuSe 8.0 box last evening. A was really astonished as I saw a new security fixed tcpdump rpm. I was not aware that there was a new security problem with tcpdump. The description was explaining that there are buffer overflows in nfs an ISAKMP packets. I was wondering, did I overlook a advisory ? Now it makes sense, so my qestion: Is it possilbel that SuSe does publish fix-rpm directly after building it to its ftp servers, and that the advisory may be published later on. e.g after all versions are rebuilded ? Regards Zoran Cvetkovic Thomas Biege wrote:
-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SuSE Security Announcement
Package: tcpdump Announcement-ID: SuSE-SA:2003:0015
-- aixigo AG - financial training, research and technology Schloß-Rahe-Straße 15, 52072 Aachen, Germany fon: +49 (0)241 936737-70, fax: +49 (0)241 936737-99 eMail: Zoran.Cvetkovic@aixigo.de, web: http://www.aixigo.de
On Mar 13, Zoran Cvetkovic
Is it possilbel that SuSe does publish fix-rpm directly after building it to its ftp servers, and that the advisory may be published later on. e.g after all versions are rebuilded ? Yes, this seems to be common practice of SuSE (which is good, IMHO).
Markus -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus@gaugusch.at X Against HTML Mail / \
Is it possilbel that SuSe does publish fix-rpm directly after building it to its ftp servers, and that the advisory may be published later on. e.g after all versions are rebuilded ? Yes, this seems to be common practice of SuSE (which is good, IMHO).
Not all of our hardware platforms build with the same speed. This forces us to publish the packages that we have already and to provide the missing ones later. It's a matter of having the hardware.
Markus
Roman.
--
- -
| Roman Drahtmüller
On Thu, 13 Mar 2003, Thomas Biege wrote:
______________________________________________________________________________
SuSE Security Announcement
Package: tcpdump <snip> 2) Pending vulnerabilities in SuSE Distributions and Workarounds:
- zlib zlib's function gzprintf() is prone to a buffer overflow if its arguments expand to more then Z_PRINTF_BUFSIZE bytes. A fixed version of zlib will be shipped with future SuSE Linux versions.
Ok, so for those of us with a current distribution of SuSE, what is the recommended procedure to deal with this bug? Do you have a CERT or upstream reference to the fix? Regards, Robb -- - Robb Romans (512) 838-0419 Linux Commando T/L 678-0419 IBM Linux Technology Center KD5SQF Ask me about the W5IBM Amateur Radio Club
Hi,
- zlib zlib's function gzprintf() is prone to a buffer overflow if its arguments expand to more then Z_PRINTF_BUFSIZE bytes. A fixed version of zlib will be shipped with future SuSE Linux versions.
Ok, so for those of us with a current distribution of SuSE, what is the recommended procedure to deal with this bug? Do you have a CERT or upstream reference to the fix?
The patch, by Solar Designer, is attached.
It's a minor bug. Exploitation is very unlikely...
Bye,
Thomas
--
Thomas Biege
participants (5)
-
Markus Gaugusch -
Robb Romans -
Roman Drahtmueller -
Thomas Biege -
Zoran Cvetkovic