Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return value.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0368 advisory.

  - Off-by-one buffer overflow in the parse_elements function in the 802.11 printer code (print-802_11.c) for     tcpdump 3.9.5 and earlier allows remote attackers to cause a denial of service (crash) via a crafted     802.11 frame. NOTE: this was originally referred to as heap-based, but it might be stack-based.
    (CVE-2007-1218)

  - Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers     to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return value.
    (CVE-2007-3798)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated tcpdump packages that fix a security issue and functionality bugs are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Tcpdump is a command line tool for monitoring network traffic.

Moritz Jodeit discovered a denial of service bug in the tcpdump IEEE 802.11 processing code. An attacker could inject a carefully crafted frame onto the IEEE 802.11 network that could crash a running tcpdump session if a certain link type was explicitly specified.
(CVE-2007-1218)

An integer overflow flaw was found in tcpdump's BGP processing code.
An attacker could execute arbitrary code with the privilege of the pcap user by injecting a crafted frame onto the network.
(CVE-2007-3798)

In addition, the following bugs have been addressed :

* if called with -C and -W switches, tcpdump would create the first savefile with the privileges of the user that executed tcpdump (usually root), rather than with ones of the pcap user. This could result in the inability to save the complete traffic log file properly without the immediate notice of the user running tcpdump.

* the arpwatch service initialization script would exit prematurely, returning a successful exit status incorrectly and preventing the status command from running in case networking is not available.

Users of tcpdump are advised to upgrade to these erratum packages, which contain backported patches that correct these issues.

Moritz Jodeit discovered a denial of service bug in the tcpdump IEEE 802.11 processing code. An attacker could inject a carefully crafted frame onto the IEEE 802.11 network that could crash a running tcpdump session if a certain link type was explicitly specified.
(CVE-2007-1218)

An integer overflow flaw was found in tcpdump's BGP processing code.
An attacker could execute arbitrary code with the privilege of the pcap user by injecting a crafted frame onto the network.
(CVE-2007-3798)

In addition, the following bugs have been addressed :

  - if called with -C and -W switches, tcpdump would create     the first savefile with the privileges of the user that     executed tcpdump (usually root), rather than with ones     of the pcap user. This could result in the inability to     save the complete traffic log file properly without the     immediate notice of the user running tcpdump.

  - the arpwatch service initialization script would exit     prematurely, returning a successful exit status     incorrectly and preventing the status command from     running in case networking is not available.

Problem description :

Moritz Jodeit discovered a denial of service bug in the tcpdump IEEE 802.11 processing code. If a certain link type was explicitly specified, an attacker could inject a carefully crafted frame onto the IEEE 802.11 network that could crash a running tcpdump session.
(CVE-2007-1218)

An integer overflow flaw was found in tcpdump's BGP processing code.
An attacker could execute arbitrary code with the privilege of the pcap user by injecting a crafted frame onto the network.
(CVE-2007-3798)

In addition, the following bugs have been addressed :

  - The arpwatch service initialization script would exit     prematurely, returning an incorrect successful exit     status and preventing the status command from running in     case networking is not available.

  - Tcpdump would not drop root privileges completely when     launched with the

  - -C option. This might have been abused by an attacker to     gain root privileges in case a security problem was     found in tcpdump. Users of tcpdump are encouraged to     specify meaningful arguments to the -Z option in case     they want tcpdump to write files with privileges other     than of the pcap user.

A buffer overflow has been found in tcpdump which can be triggered while displaying BGP packets. This could be exploited by an attacker to execute malicious code under the privileges of the user running tcpdump by presenting specially prepared BGP packets to tcpdump. This issue is tracked by CVE-2007-3798.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2007-009 applied. 

This update contains several security fixes for a large number of programs.

This update fixes a buffer overlow that could be triggered when displaying BGP packets. (CVE-2007-3798)

A flaw was discovered in the BGP dissector of tcpdump. Remote attackers could send specially crafted packets and execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated tcpdump packages that fix a security issue and functionality bugs are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Tcpdump is a command line tool for monitoring network traffic.

Moritz Jodeit discovered a denial of service bug in the tcpdump IEEE 802.11 processing code. If a certain link type was explicitly specified, an attacker could inject a carefully crafted frame onto the IEEE 802.11 network that could crash a running tcpdump session.
(CVE-2007-1218)

An integer overflow flaw was found in tcpdump's BGP processing code.
An attacker could execute arbitrary code with the privilege of the pcap user by injecting a crafted frame onto the network.
(CVE-2007-3798)

In addition, the following bugs have been addressed :

* The arpwatch service initialization script would exit prematurely, returning an incorrect successful exit status and preventing the status command from running in case networking is not available.

* Tcpdump would not drop root privileges completely when launched with the -C option. This might have been abused by an attacker to gain root privileges in case a security problem was found in tcpdump. Users of tcpdump are encouraged to specify meaningful arguments to the -Z option in case they want tcpdump to write files with privileges other than of the pcap user.

Users of tcpdump are advised to upgrade to these erratum packages, which contain backported patches that correct these issues.

New upstream release.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a buffer overlow that could be triggered when displaying BGP packets (CVE-2007-3798).

New tcpdump packages are available for Slackware 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0 to fix a security issue.

It was discovered that an integer overflow in the BGP dissector of tcpdump, a powerful tool for network monitoring and data acquisition, may lead to the execution of arbitrary code.

- CVE-2007-3798

Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return value.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An un-checked return value in the BGP dissector code can result in an integer overflow. This value is used in subsequent buffer management operations, resulting in a stack based buffer overflow under certain circumstances. Impact : By crafting malicious BGP packets, an attacker could exploit this vulnerability to execute code or crash the tcpdump process on the target system. This code would be executed in the context of the user running tcpdump(1). It should be noted that tcpdump(1) requires privileges in order to open live network interfaces. Workaround : No workaround is available.

The remote host is affected by the vulnerability described in GLSA-200707-14 (tcpdump: Integer overflow)

    mu-b from Digital Labs discovered that the return value of a snprintf()     call is not properly checked before being used. This could lead to an     integer overflow.
  Impact :

    A remote attacker could send specially crafted BGP packets on a network     being monitored with tcpdump, possibly resulting in the execution of     arbitrary code with the privileges of the user running tcpdump, which     is usually root.
  Workaround :

    There is no known workaround at this time.

An integer overflow in tcpdump could allow a remote attacker to execute arbitrary code via crafted TLVs in a BGP packet.

Updated packages have been patched to prevent this issue.

ID	Name	Product	Family	Severity
180614	Oracle Linux 5 : tcpdump (ELSA-2007-0368)	Nessus	Oracle Linux Local Security Checks	critical
67051	CentOS 4 : tcpdump (CESA-2007:0387)	Nessus	CentOS Local Security Checks	medium
60310	Scientific Linux Security Update : tcpdump on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60299	Scientific Linux Security Update : tcpdump on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
41144	SuSE9 Security Update : tcpdump (YOU Patch Number 11696)	Nessus	SuSE Local Security Checks	medium
29723	Mac OS X Multiple Vulnerabilities (Security Update 2007-009)	Nessus	MacOS X Local Security Checks	critical
29588	SuSE 10 Security Update : tcpdump (ZYPP Patch Number 4037)	Nessus	SuSE Local Security Checks	medium
28235	RHEL 4 : tcpdump (RHSA-2007:0387)	Nessus	Red Hat Local Security Checks	medium
28094	Ubuntu 6.06 LTS / 6.10 / 7.04 : tcpdump vulnerability (USN-492-1)	Nessus	Ubuntu Local Security Checks	medium
27828	RHEL 5 : tcpdump (RHSA-2007:0368)	Nessus	Red Hat Local Security Checks	medium
27711	Fedora 7 : tcpdump-3.9.7-1.fc7 (2007-1361)	Nessus	Fedora Local Security Checks	medium
27466	openSUSE 10 Security Update : tcpdump (tcpdump-4036)	Nessus	SuSE Local Security Checks	medium
25907	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 9.0 / 9.1 : tcpdump (SSA:2007-230-01)	Nessus	Slackware Local Security Checks	medium
25861	Debian DSA-1353-1 : tcpdump - integer overflow	Nessus	Debian Local Security Checks	medium
25839	Fedora Core 6 : tcpdump-3.9.4-11.fc6 (2007-654)	Nessus	Fedora Local Security Checks	medium
25833	FreeBSD : FreeBSD -- Buffer overflow in tcpdump(1) (2dc764fa-40c0-11dc-aeac-02e0185f8d72)	Nessus	FreeBSD Local Security Checks	medium
25810	GLSA-200707-14 : tcpdump: Integer overflow	Nessus	Gentoo Local Security Checks	medium
25794	Mandrake Linux Security Advisory : tcpdump (MDKSA-2007:148)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2007-3798

critical

Tenable Plugins

critical

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium