RHEL 2.1 / 3 : tcpdump (RHSA-2004:219)

This script is Copyright (C) 2004-2014 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing one or more security updates.

Description :

Updated tcpdump, libpcap, and arpwatch packages fix vulnerabilities in
ISAKMP parsing.

Tcpdump is a command-line tool for monitoring network traffic.

Tcpdump v3.8.1 and earlier versions contained multiple flaws in the
packet display functions for the ISAKMP protocol. Upon receiving
specially crafted ISAKMP packets, TCPDUMP would try to read beyond the
end of the packet capture buffer and subsequently crash.

Users of tcpdump are advised to upgrade to these erratum packages,
which contain backported security patches and are not vulnerable to
these issues.

See also :

https://www.redhat.com/security/data/cve/CVE-2004-0183.html
https://www.redhat.com/security/data/cve/CVE-2004-0184.html
http://marc.info/?l=bugtraq&m=108067265931525&w=2
http://rhn.redhat.com/errata/RHSA-2004-219.html

Solution :

Update the affected arpwatch, libpcap and / or tcpdump packages.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)

Family: Red Hat Local Security Checks

Nessus Plugin ID: 12498 ()

Bugtraq ID:

CVE ID: CVE-2004-0183
CVE-2004-0184