The bgp_update_print function in tcpdump 3.x does not properly handle a -1 return value from the decode_prefix4 function, which allows remote attackers to cause a denial of service (infinite loop) via a crafted BGP packet.

Updated tcpdump packages that fix a security issue are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Tcpdump is a command line tool for monitoring network traffic.

A denial of service bug was found in tcpdump during the processing of certain network packets. It is possible for an attacker to inject a carefully crafted packet onto the network, crashing a running tcpdump session. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1267 to this issue.

Users of tcpdump are advised to upgrade to these erratum packages, which contain backported security patches and are not vulnerable to these issues.

It was discovered that certain invalid BGP packets triggered an infinite loop in tcpdump, which caused tcpdump to stop working. This could be abused by a remote attacker to bypass tcpdump analysis of network traffic.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Simon Nielsen discovered that the BGP dissector in tcpdump, a powerful tool for network monitoring and data acquisition, does not properly handle a -1 return value from an internal function that decodes data packets. A specially crafted BGP packet can cause a denial of service via an infinite loop.

New tcpdump packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, and -current to fix a security issue. A specially crafted BGP packet can cause tcpdump to go into an infinite loop, creating a denial of service where network monitoring is disabled.

Problem Description Several tcpdump protocol decoders contain programming errors which can cause them to go into infinite loops.
Impact An attacker can inject specially crafted packets into the network which, when processed by tcpdump, could lead to a denial-of-service. After the attack, tcpdump would no longer capture traffic, and would potentially use all available processor time.

A Denial of Service vulnerability was found in tcpdump during the processing of certain network packages. Because of this flaw, it was possible for an attacker to inject a carefully crafted packet onto the network which would crash a running tcpdump session.

The updated packages have been patched to correct this problem. This problem does not affect at least tcpdump 3.8.1 and earlier.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:505 advisory.

  - security flaw (CVE-2005-1267)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- Tue Jun 07 2005 Martin Stransky <stransky at redhat.com>
    - 14:3.8.2-9.FC3

  - fix for CVE-2005-1267 - BGP DoS, #159209

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200505-06 (TCPDump: Decoding routines Denial of Service vulnerability)

    TCPDump improperly handles and decodes ISIS (CAN-2005-1278), BGP     (CAN-2005-1267, CAN-2005-1279), LDP (CAN-2005-1279) and RSVP     (CAN-2005-1280) packets. TCPDump might loop endlessly after receiving     malformed packets.
  Impact :

    A malicious remote attacker can exploit the decoding issues for a     Denial of Service attack by sending specially crafted packets, possibly     causing TCPDump to loop endlessly.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
21942	CentOS 4 : tcpdump (CESA-2005:505)	Nessus	CentOS Local Security Checks	medium
20534	Ubuntu 4.10 / 5.04 : tcpdump vulnerability (USN-141-1)	Nessus	Ubuntu Local Security Checks	medium
19962	Debian DSA-854-1 : tcpdump - infinite loop	Nessus	Debian Local Security Checks	medium
19209	Slackware 10.0 / 10.1 / 8.1 / 9.0 / 9.1 / current : tcpdump DoS (SSA:2005-195-10)	Nessus	Slackware Local Security Checks	medium
19052	FreeBSD : tcpdump -- infinite loops in protocol decoding (9fae0f1f-df82-11d9-b875-0001020eed82)	Nessus	FreeBSD Local Security Checks	medium
18498	Mandrake Linux Security Advisory : tcpdump (MDKSA-2005:101)	Nessus	Mandriva Local Security Checks	medium
18475	RHEL 4 : tcpdump (RHSA-2005:505)	Nessus	Red Hat Local Security Checks	high
18439	Fedora Core 3 : tcpdump-3.8.2-9.FC3 (2005-406)	Nessus	Fedora Local Security Checks	medium
18232	GLSA-200505-06 : TCPDump: Decoding routines Denial of Service vulnerability	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2005-1267

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

high

medium

medium