Off-by-one buffer overflow in the parse_elements function in the 802.11 printer code (print-802_11.c) for tcpdump 3.9.5 and earlier allows remote attackers to cause a denial of service (crash) via a crafted 802.11 frame. NOTE: this was originally referred to as heap-based, but it might be stack-based.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0368 advisory.

  - Off-by-one buffer overflow in the parse_elements function in the 802.11 printer code (print-802_11.c) for     tcpdump 3.9.5 and earlier allows remote attackers to cause a denial of service (crash) via a crafted     802.11 frame. NOTE: this was originally referred to as heap-based, but it might be stack-based.
    (CVE-2007-1218)

  - Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers     to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return value.
    (CVE-2007-3798)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated tcpdump packages that fix a security issue and functionality bugs are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Tcpdump is a command line tool for monitoring network traffic.

Moritz Jodeit discovered a denial of service bug in the tcpdump IEEE 802.11 processing code. An attacker could inject a carefully crafted frame onto the IEEE 802.11 network that could crash a running tcpdump session if a certain link type was explicitly specified.
(CVE-2007-1218)

An integer overflow flaw was found in tcpdump's BGP processing code.
An attacker could execute arbitrary code with the privilege of the pcap user by injecting a crafted frame onto the network.
(CVE-2007-3798)

In addition, the following bugs have been addressed :

* if called with -C and -W switches, tcpdump would create the first savefile with the privileges of the user that executed tcpdump (usually root), rather than with ones of the pcap user. This could result in the inability to save the complete traffic log file properly without the immediate notice of the user running tcpdump.

* the arpwatch service initialization script would exit prematurely, returning a successful exit status incorrectly and preventing the status command from running in case networking is not available.

Users of tcpdump are advised to upgrade to these erratum packages, which contain backported patches that correct these issues.

Moritz Jodeit discovered a denial of service bug in the tcpdump IEEE 802.11 processing code. An attacker could inject a carefully crafted frame onto the IEEE 802.11 network that could crash a running tcpdump session if a certain link type was explicitly specified.
(CVE-2007-1218)

An integer overflow flaw was found in tcpdump's BGP processing code.
An attacker could execute arbitrary code with the privilege of the pcap user by injecting a crafted frame onto the network.
(CVE-2007-3798)

In addition, the following bugs have been addressed :

  - if called with -C and -W switches, tcpdump would create     the first savefile with the privileges of the user that     executed tcpdump (usually root), rather than with ones     of the pcap user. This could result in the inability to     save the complete traffic log file properly without the     immediate notice of the user running tcpdump.

  - the arpwatch service initialization script would exit     prematurely, returning a successful exit status     incorrectly and preventing the status command from     running in case networking is not available.

Problem description :

Moritz Jodeit discovered a denial of service bug in the tcpdump IEEE 802.11 processing code. If a certain link type was explicitly specified, an attacker could inject a carefully crafted frame onto the IEEE 802.11 network that could crash a running tcpdump session.
(CVE-2007-1218)

An integer overflow flaw was found in tcpdump's BGP processing code.
An attacker could execute arbitrary code with the privilege of the pcap user by injecting a crafted frame onto the network.
(CVE-2007-3798)

In addition, the following bugs have been addressed :

  - The arpwatch service initialization script would exit     prematurely, returning an incorrect successful exit     status and preventing the status command from running in     case networking is not available.

  - Tcpdump would not drop root privileges completely when     launched with the

  - -C option. This might have been abused by an attacker to     gain root privileges in case a security problem was     found in tcpdump. Users of tcpdump are encouraged to     specify meaningful arguments to the -Z option in case     they want tcpdump to write files with privileges other     than of the pcap user.

Off-by-one buffer overflow in the parse_elements function in the 802.11 printer code (print-802_11.c) for tcpdump 3.9.5 and earlier allows remote attackers to cause a denial of service (crash) via a crafted 802.11 frame.

Updated packages have been patched to prevent this issue.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2007-009 applied. 

This update contains several security fixes for a large number of programs.

Moritz Jodeit discovered that tcpdump had an overflow in the 802.11 packet parser. Remote attackers could send specially crafted packets, crashing tcpdump, possibly leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated tcpdump packages that fix a security issue and functionality bugs are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Tcpdump is a command line tool for monitoring network traffic.

Moritz Jodeit discovered a denial of service bug in the tcpdump IEEE 802.11 processing code. If a certain link type was explicitly specified, an attacker could inject a carefully crafted frame onto the IEEE 802.11 network that could crash a running tcpdump session.
(CVE-2007-1218)

An integer overflow flaw was found in tcpdump's BGP processing code.
An attacker could execute arbitrary code with the privilege of the pcap user by injecting a crafted frame onto the network.
(CVE-2007-3798)

In addition, the following bugs have been addressed :

* The arpwatch service initialization script would exit prematurely, returning an incorrect successful exit status and preventing the status command from running in case networking is not available.

* Tcpdump would not drop root privileges completely when launched with the -C option. This might have been abused by an attacker to gain root privileges in case a security problem was found in tcpdump. Users of tcpdump are encouraged to specify meaningful arguments to the -Z option in case they want tcpdump to write files with privileges other than of the pcap user.

Users of tcpdump are advised to upgrade to these erratum packages, which contain backported patches that correct these issues.

Moritz Jodeit discovered an off-by-one buffer overflow in tcpdump, a powerful tool for network monitoring and data acquisition, which allows denial of service.

- Thu Mar 15 2007 Miroslav Lichvar <mlichvar at     redhat.com> - 14:3.9.4-4.fc5

    - fix buffer overflow in 802.11 printer (#232349,       CVE-2007-1218)

    - require /usr/sbin/sendmail (#232363)

    - Wed Nov 8 2006 Miroslav Lichvar <mlichvar at       redhat.com> - 14:3.9.4-3.fc5

    - fix processing of Prism and AVS headers (#207435)

    - fix arp2ethers script

    - update ethercodes.dat

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Thu Mar 15 2007 Miroslav Lichvar <mlichvar at     redhat.com> - 14:3.9.4-10.fc6

    - fix buffer overflow in 802.11 printer (#232349,       CVE-2007-1218)

    - require /usr/sbin/sendmail (#232363)

    - Fri Nov 17 2006 Miroslav Lichvar <mlichvar at       redhat.com> - 14:3.9.4-9

    - fix processing of Prism and AVS headers (#206686)

    - fix arp2ethers script

    - update ethercodes.dat

    - move pcap man page to devel package

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Off-by-one buffer overflow in the parse_elements function in the 802.11 printer code (print-802_11.c) for tcpdump 3.9.5 and earlier allows remote attackers to cause a denial of service (crash) via a crafted 802.11 frame. NOTE: this was originally referred to as heap-based, but it might be stack-based.

Updated packages have been patched to address this issue.

ID	Name	Product	Family	Severity
180614	Oracle Linux 5 : tcpdump (ELSA-2007-0368)	Nessus	Oracle Linux Local Security Checks	critical
67051	CentOS 4 : tcpdump (CESA-2007:0387)	Nessus	CentOS Local Security Checks	medium
60310	Scientific Linux Security Update : tcpdump on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60299	Scientific Linux Security Update : tcpdump on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
36699	Mandrake Linux Security Advisory : tcpdump (MDKSA-2007:155)	Nessus	Mandriva Local Security Checks	medium
29723	Mac OS X Multiple Vulnerabilities (Security Update 2007-009)	Nessus	MacOS X Local Security Checks	critical
28235	RHEL 4 : tcpdump (RHSA-2007:0387)	Nessus	Red Hat Local Security Checks	medium
28023	Ubuntu 5.10 / 6.06 LTS / 6.10 : tcpdump vulnerability (USN-429-1)	Nessus	Ubuntu Local Security Checks	medium
27828	RHEL 5 : tcpdump (RHSA-2007:0368)	Nessus	Red Hat Local Security Checks	medium
24881	Debian DSA-1272-1 : tcpdump - buffer overflow	Nessus	Debian Local Security Checks	medium
24837	Fedora Core 5 : tcpdump-3.9.4-4.fc5 (2007-348)	Nessus	Fedora Local Security Checks	medium
24836	Fedora Core 6 : tcpdump-3.9.4-10.fc6 (2007-347)	Nessus	Fedora Local Security Checks	medium
24806	Mandrake Linux Security Advisory : tcpdump (MDKSA-2007:056)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2007-1218

high

Tenable Plugins

critical

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium