RHEL 2.1 : tcpdump (RHSA-2003:085)
Medium Nessus Plugin ID 12375
SynopsisThe remote Red Hat host is missing one or more security updates.
DescriptionUpdated tcpdump packages are available to fix a denial of service vulnerability in tcpdump.
[Updated 12 March 2003] Added packages for Red Hat Enterprise Linux ES and Red Hat Enterprise Linux WS
Tcpdump is a command-line tool for monitoring network traffic.
The ISAKMP parser in tcpdump 3.6 through 3.7.1 allows remote attackers to cause a denial of service (CPU consumption) via a certain malformed ISAKMP packet to UDP port 500, which causes tcpdump to enter an infinite loop.
Users of tcpdump are advised to upgrade to these errata packages which contain a patch to correct this issue.
SolutionUpdate the affected arpwatch, libpcap and / or tcpdump packages.