The isis_print function, as called by isoclns_print, in tcpdump 3.9.1 and earlier allows remote attackers to cause a denial of service (infinite loop) via a zero length, as demonstrated using a GRE packet.

Updated tcpdump packages that fix several security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

This updated package also adds support for output files larger than 2 GB.

Tcpdump is a command-line tool for monitoring network traffic.

Several denial of service bugs were found in the way tcpdump processes certain network packets. It is possible for an attacker to inject a carefully crafted packet onto the network, crashing a running tcpdump session. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-1278, CVE-2005-1279, and CVE-2005-1280 to these issues.

The tcpdump utility can now write a file larger than 2 GB.

Users of tcpdump are advised to upgrade to these erratum packages, which contain backported security patches and are not vulnerable to these issues.

Updated tcpdump packages that fix several security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

These updated packages also add support for output files larger than 2 GB, add support for some new VLAN IDs, and fix message parsing on 64bit architectures.

Tcpdump is a command-line tool for monitoring network traffic.

Several denial of service bugs were found in the way tcpdump processes certain network packets. It is possible for an attacker to inject a carefully crafted packet onto the network, crashing a running tcpdump session. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-1278, CVE-2005-1279, and CVE-2005-1280 to these issues.

Additionally, the tcpdump utility can now write a file larger than 2 GB, parse some new VLAN IDs, and parse messages on 64bit architectures.

Users of tcpdump are advised to upgrade to these erratum packages, which contain backported security patches and are not vulnerable to these issues.

It was discovered that certain invalid GRE, LDP, BGP, and RSVP packets triggered infinite loops in tcpdump, which caused tcpdump to stop working. This could be abused by a remote attacker to bypass tcpdump analysis of network traffic.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Problem Description Several tcpdump protocol decoders contain programming errors which can cause them to go into infinite loops.
Impact An attacker can inject specially crafted packets into the network which, when processed by tcpdump, could lead to a denial-of-service. After the attack, tcpdump would no longer capture traffic, and would potentially use all available processor time.

A number of Denial of Service vulnerabilities were discovered in the way that tcpdump processes certain network packets. If abused, these flaws can allow a remote attacker to inject a carefully crafted packet onto the network, crashing tcpdump.

The provided packages have been patched to correct these issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:417 advisory.

    Tcpdump is a command-line tool for monitoring network traffic.

    Several denial of service bugs were found in the way tcpdump processes     certain network packets. It is possible for an attacker to inject a     carefully crafted packet onto the network, crashing a running tcpdump     session. The Common Vulnerabilities and Exposures project (cve.mitre.org)     has assigned the names CAN-2005-1278, CAN-2005-1279, and CAN-2005-1280 to     these issues.

    The tcpdump utility can now write a file larger than 2 GB.

    Users of tcpdump are advised to upgrade to these erratum packages, which     contain backported security patches and are not vulnerable to these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200505-06 (TCPDump: Decoding routines Denial of Service vulnerability)

    TCPDump improperly handles and decodes ISIS (CAN-2005-1278), BGP     (CAN-2005-1267, CAN-2005-1279), LDP (CAN-2005-1279) and RSVP     (CAN-2005-1280) packets. TCPDump might loop endlessly after receiving     malformed packets.
  Impact :

    A malicious remote attacker can exploit the decoding issues for a     Denial of Service attack by sending specially crafted packets, possibly     causing TCPDump to loop endlessly.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
21936	CentOS 3 / 4 : tcpdump (CESA-2005:417)	Nessus	CentOS Local Security Checks	medium
21823	CentOS 3 : tcpdump (CESA-2005:421)	Nessus	CentOS Local Security Checks	medium
20507	Ubuntu 4.10 / 5.04 : tcpdump vulnerabilities (USN-119-1)	Nessus	Ubuntu Local Security Checks	medium
19052	FreeBSD : tcpdump -- infinite loops in protocol decoding (9fae0f1f-df82-11d9-b875-0001020eed82)	Nessus	FreeBSD Local Security Checks	medium
18276	Mandrake Linux Security Advisory : tcpdump (MDKSA-2005:087)	Nessus	Mandriva Local Security Checks	medium
18239	RHEL 3 : tcpdump (RHSA-2005:421)	Nessus	Red Hat Local Security Checks	medium
18238	RHEL 4 : tcpdump (RHSA-2005:417)	Nessus	Red Hat Local Security Checks	high
18232	GLSA-200505-06 : TCPDump: Decoding routines Denial of Service vulnerability	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2005-1278

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

high

medium