isakmp_sub_print in tcpdump 3.6 through 3.7.1 allows remote attackers to cause a denial of service (CPU consumption) via a certain malformed ISAKMP packet to UDP port 500, which causes tcpdump to enter an infinite loop.

Andrew Griffiths and iDEFENSE Labs discovered a problem in tcpdump, a powerful tool for network monitoring and data acquisition. An attacker is able to send a specially crafted network packet which causes tcpdump to enter an infinite loop.

In addition to the above problem the tcpdump developers discovered a potential infinite loop when parsing malformed BGP packets. They also discovered a buffer overflow that can be exploited with certain malformed NFS packets.

A vulnerability was discovered by Andrew Griffiths and iDEFENSE Labs in the tcpdump program. By sending a specially crafted network packet, an attacker is able to to cause tcpdump to enter an infinite loop. In addition, the tcpdump developers found a potential infinite loop when tcpdump parses malformed BGP packets. A buffer overflow was also discovered that can be exploited with certain malformed NFS packets.

The remote host is missing the patch for the advisory SUSE-SA:2003:0015 (tcpdump).


The network traffic analyzer tool tcpdump is vulnerable to a denial-of- service condition while parsing ISAKMP or BGP packets. This bug can be exploited remotely by an attacker to stop the use of tcpdump for analyzing network traffic for signs of security breaches or alike.
Another bug may lead to system compromise due to the handling of malformed NFS packets send by an attacker.
Please note, that tcpdump drops root privileges right after allocating the needed raw sockets.

There is no temporary fix known.

Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command 'rpm -Fhv file.rpm' to apply the update.

Updated tcpdump packages are available to fix a denial of service vulnerability in tcpdump.

[Updated 12 March 2003] Added packages for Red Hat Enterprise Linux ES and Red Hat Enterprise Linux WS

Tcpdump is a command-line tool for monitoring network traffic.

The ISAKMP parser in tcpdump 3.6 through 3.7.1 allows remote attackers to cause a denial of service (CPU consumption) via a certain malformed ISAKMP packet to UDP port 500, which causes tcpdump to enter an infinite loop.

Users of tcpdump are advised to upgrade to these errata packages which contain a patch to correct this issue.

ID	Name	Product	Family	Severity
15092	Debian DSA-255-1 : tcpdump - infinite loop	Nessus	Debian Local Security Checks	high
14011	Mandrake Linux Security Advisory : tcpdump (MDKSA-2003:027)	Nessus	Mandriva Local Security Checks	high
13779	SUSE-SA:2003:0015: tcpdump	Nessus	SuSE Local Security Checks	medium
12375	RHEL 2.1 : tcpdump (RHSA-2003:085)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2003-0108

high

Tenable Plugins

high

high

medium

medium