tcpdump before 3.8.1 allows remote attackers to cause a denial of service (infinite loop) via certain ISAKMP packets, a different vulnerability than CVE-2004-0057.

Jonathan Heusser discovered vulnerabilities in tcpdump's L2TP, ISAKMP, and RADIUS protocol handlers. These vulnerabilities may be used by an attacker to crash a running `tcpdump' process.

Multiple vulnerabilities were discovered in tcpdump, a tool for inspecting network traffic. If a vulnerable version of tcpdump attempted to examine a maliciously constructed packet, a number of buffer overflows could be exploited to crash tcpdump, or potentially execute arbitrary code with the privileges of the tcpdump process.

  - CAN-2003-1029 - infinite loop and memory consumption in     processing L2TP packets
  - CAN-2003-0989, CAN-2004-0057 - infinite loops in     processing ISAKMP packets

  - CAN-2004-0055 - segmentation fault caused by a RADIUS     attribute with a large length value

The remote host is affected by the vulnerability described in GLSA-200404-03 (Tcpdump Vulnerabilities in ISAKMP Parsing)

    There are two specific vulnerabilities in tcpdump, outlined in [ reference     1 ]. In the first scenario, an attacker may send a specially crafted ISAKMP     Delete packet which causes tcpdump to read past the end of its buffer. In     the second scenario, an attacker may send an ISAKMP packet with the wrong     payload length, again causing tcpdump to read past the end of a buffer.
  Impact :

    Remote attackers could potentially cause tcpdump to crash or execute     arbitrary code as the 'pcap' user.
  Workaround :

    There is no known workaround at this time. All tcpdump users are encouraged     to upgrade to the latest available version.

A number of vulnerabilities were discovered in tcpdump versions prior to 3.8.1 that, if fed a maliciously crafted packet, could be exploited to crash tcpdump or potentially execute arbitrary code with the privileges of the user running tcpdump. These vulnerabilities include :

An infinite loop and memory consumption processing L2TP packets (CVE-2003-1029).

Infinite loops in processing ISAKMP packets (CVE-2003-0989, CVE-2004-0057).

A segmentation fault caused by a RADIUS attribute with a large length value (CVE-2004-0055).

The updated packages are patched to correct these problem.

Updated tcpdump, libpcap, and arpwatch packages fix vulnerabilities in ISAKMP and RADIUS parsing.

Tcpdump is a command-line tool for monitoring network traffic.

George Bakos discovered flaws in the ISAKMP decoding routines of tcpdump versions prior to 3.8.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0989 to this issue.

Jonathan Heusser discovered an additional flaw in the ISAKMP decoding routines for tcpdump 3.8.1 and earlier. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0057 to this issue.

Jonathan Heusser discovered a flaw in the print_attr_string function in the RADIUS decoding routines for tcpdump 3.8.1 and earlier. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0055 to this issue.

Remote attackers could potentially exploit these issues by sending carefully-crafted packets to a victim. If the victim uses tcpdump, these pakets could result in a denial of service, or possibly execute arbitrary code as the 'pcap' user.

Users of tcpdump are advised to upgrade to these erratum packages, which contain backported security patches and are not vulnerable to these issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated tcpdump, libpcap, and arpwatch packages fix vulnerabilities in ISAKMP and RADIUS parsing.

[Updated 15 Jan 2004] Updated the text description to better describe the vulnerabilities found by Jonathan Heusser and give them CVE names.

Tcpdump is a command-line tool for monitoring network traffic.

George Bakos discovered flaws in the ISAKMP decoding routines of tcpdump versions prior to 3.8.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0989 to this issue.

Jonathan Heusser discovered an additional flaw in the ISAKMP decoding routines for tcpdump 3.8.1 and earlier. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0057 to this issue.

Jonathan Heusser discovered a flaw in the print_attr_string function in the RADIUS decoding routines for tcpdump 3.8.1 and earlier. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0055 to this issue.

Remote attackers could potentially exploit these issues by sending carefully-crafted packets to a victim. If the victim uses tcpdump, these pakets could result in a denial of service, or possibly execute arbitrary code as the 'pcap' user.

Users of tcpdump are advised to upgrade to these erratum packages, which contain backported security patches and are not vulnerable to these issues.

ID	Name	Product	Family	Severity
37028	FreeBSD : L2TP, ISAKMP, and RADIUS parsing vulnerabilities in tcpdump (96ba2dae-4ab0-11d8-96f2-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	high
15262	Debian DSA-425-1 : tcpdump - multiple vulnerabilities	Nessus	Debian Local Security Checks	high
14468	GLSA-200404-03 : Tcpdump Vulnerabilities in ISAKMP Parsing	Nessus	Gentoo Local Security Checks	high
14108	Mandrake Linux Security Advisory : tcpdump (MDKSA-2004:008)	Nessus	Mandriva Local Security Checks	high
13683	Fedora Core 1 : tcpdump-3.7.2-8.fc1.1 (2004-092)	Nessus	Fedora Local Security Checks	high
13682	Fedora Core 1 : tcpdump-3.7.2-7.fc1.1 (2004-090)	Nessus	Fedora Local Security Checks	high
12448	RHEL 2.1 / 3 : tcpdump (RHSA-2004:008)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2003-0989

high

Tenable Plugins

high

high

high

high

high

high

high