Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 90541 - net-analyzer/tcpdump: TCPDump {ISIS|RSVP|LDP|BGP} Decoding Routines Denial Of Service Vulnerability
Summary: net-analyzer/tcpdump: TCPDump {ISIS|RSVP|LDP|BGP} Decoding Routines Denial Of...
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
Whiteboard: A3 [glsa] jaervosz
Depends on:
Reported: 2005-04-26 14:18 UTC by Adir Abraham
Modified: 2005-08-15 21:53 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

tcpdump-3.8.3-gentoo.patch (tcpdump-3.8.3-gentoo.patch,3.91 KB, patch)
2005-05-06 13:59 UTC, Marcelo Goes (RETIRED)
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Adir Abraham 2005-04-26 14:18:16 UTC

tcpdump is prone to a vulnerability that may allow a remote attacker to cause a denial of service condition in the software. The issue occurs due to the way tcpdump decodes Intermediate System to Intermediate System (ISIS) packets. A remote attacker may cause the software to enter an infinite loop by sending malformed ISIS packets resulting in the software hanging.

tcpdump versions up to and including 3.9.x/CVS are reported prone to this issue.

Reproducible: Always
Steps to Reproduce:

I suspect that it's a duplicate of
but I'm not sure (maybe bug #13391's solution depends on this bug's solution).

Anyway, an exploit for this specific security bug is available:
Comment 2 Adir Abraham 2005-04-26 17:19:57 UTC
Correction: when I wrote "#13391", I was refering to securityfocus' number ofcourse. 
Gentoo's bug number about that issue is 90539 ( ). Sorry.
Comment 3 Thierry Carrez (RETIRED) gentoo-dev 2005-04-28 09:59:20 UTC
Patches are showing up in their CVS, see for example :

Given the scope of this (denying service to a packet logger), probably better to wait for their release.
Comment 4 Adir Abraham 2005-05-03 02:22:02 UTC
It seems that Fedora released some updates that fix these problems. You might want to check
Or in check:
4b740bfe93581978552145842e23898d SRPMS/tcpdump-3.8.2-8.FC3.src.rpm
380ab25ad5a4908c2b8bf8461c29317a x86_64/tcpdump-3.8.2-8.FC3.x86_64.rpm
e25dadaa9ab7e602ab6c9b4aee51b536 x86_64/libpcap-0.8.3-8.FC3.x86_64.rpm
f0bcba7f52b8a0c10a5b11488313cb3e x86_64/arpwatch-2.1a13-8.FC3.x86_64.rpm
0f7d020a9e50561b9fbb41ccc135ab24 x86_64/debug/tcpdump-debuginfo-3.8.2-8.FC3.x86_64.rpm
a50375f8e7edf7a88dea70dcb5df98c4 x86_64/libpcap-0.8.3-8.FC3.i386.rpm
031f3ec5c206b4616f2b30f4949ad345 i386/tcpdump-3.8.2-8.FC3.i386.rpm
a50375f8e7edf7a88dea70dcb5df98c4 i386/libpcap-0.8.3-8.FC3.i386.rpm
7fcb261a49f062939946d84a7816b864 i386/arpwatch-2.1a13-8.FC3.i386.rpm
c5006240d5c4c6e4f9c892c882a1ca7b i386/debug/tcpdump-debuginfo-3.8.2-8.FC3.i386.rpm
Comment 5 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2005-05-06 11:49:58 UTC
Ubuntu also released their fix. Netmon please provide an updated ebuild.
Comment 6 Marcelo Goes (RETIRED) gentoo-dev 2005-05-06 13:59:03 UTC
Created attachment 58223 [details, diff]

This patch is based off Debian's 50_misc_dos.dpatch.
Comment 7 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2005-05-06 14:51:09 UTC
Marcelo/netmon please commit an updated ebuild. Security can handle stable marking if necessary.
Comment 8 Marcelo Goes (RETIRED) gentoo-dev 2005-05-06 15:18:46 UTC
tcpdump-3.8.3-r2.ebuild in CVS, ready for keywording
Comment 9 Daniel Black (RETIRED) gentoo-dev 2005-05-06 15:41:24 UTC
x86 and ppc stable.
Comment 10 Andrej Kacian (RETIRED) gentoo-dev 2005-05-06 15:58:56 UTC
amd64 happy
Comment 11 Gustavo Zacarias (RETIRED) gentoo-dev 2005-05-06 18:31:12 UTC
sparc stable.
Comment 12 Michael Hanselmann (hansmi) (RETIRED) gentoo-dev 2005-05-07 02:20:05 UTC
Stable on hppa.
Comment 13 Omkhar Arasaratnam (RETIRED) gentoo-dev 2005-05-07 09:13:43 UTC
ppc64 is stable
Comment 14 Bryan Østergaard (RETIRED) gentoo-dev 2005-05-07 10:15:20 UTC
Stable on alpha + ia64.
Comment 15 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2005-05-09 12:47:40 UTC
GLSA 200505-06

mips, arm please remember to mark stable to benefit from the GLSA.
Comment 16 Hardave Riar (RETIRED) gentoo-dev 2005-07-02 20:23:24 UTC
Later version already stable on mips.