-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                     ESB-2001.296 -- FreeBSD-SA-01:48
                  tcpdump contains remote buffer overflow
                               18 July 2001

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                tcpdump
Vendor:                 FreeBSD
Operating System:       FreeBSD 4.x prior to 4.4
                        FreeBSD 4.3-STABLE prior to the correction date
                        BSD
Impact:                 Denial of Service
                        Root Compromise
Access Required:        Remote

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----

=============================================================================
FreeBSD-SA-01:48                                           Security Advisory
                                                                FreeBSD, Inc.

Topic:          tcpdump contains remote buffer overflow

Category:       core
Module:         tcpdump
Announced:      2001-07-17
Credits:        Nick Cleaton <nick@cleaton.net>
Affects:        All releases of FreeBSD 4.x prior to 4.4,
                FreeBSD 4.3-STABLE prior to the correction date
		FreeBSD 3.x is unaffected.
Corrected:      2001-07-09
Vendor status:  Patch released
FreeBSD only:   NO

I.   Background

tcpdump is a tool for monitoring network traffic activity.

II.  Problem Description

An overflowable buffer was found in the version of tcpdump included
with FreeBSD 4.x.  Due to incorrect string length handling in the
decoding of AFS RPC packets, a remote user may be able to overflow a
buffer causing the local tcpdump process to crash.  In addition, it
may be possible to execute arbitrary code with the privileges of the
user running tcpdump, often root.

The effects of this vulnerability are similiar to those described in
advisory FreeBSD-SA-00:61.tcpdump.v1.1.

All released versions of FreeBSD prior to the correction date
including 4.3-RELEASE are vulnerable to this problem, however it does
not affect the FreeBSD 3.x branch which includes an older version of
tcpdump.

III. Impact

Remote users can cause the local tcpdump process to crash, and may be
able to cause arbitrary code to be executed as the user running
tcpdump, often root.

IV.  Workaround

Do not use vulnerable versions of tcpdump in network environments
which may contain packets from untrusted sources.

V.   Solution

One of the following:

1) Upgrade your vulnerable FreeBSD system to 4.3-STABLE or the
RELENG_4_3 security branch after the respective correction dates.

2) FreeBSD 4.x systems prior to the correction date:

Download the patch and the detached PGP signature from the following
locations, and verify the signature using your PGP utility.

ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:48/tcpdump-4.x.patch
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:48/tcpdump-4.x.patch.asc

# cd /usr/src/contrib/tcpdump
# patch -p < /path/to/patch
# cd /usr/src/usr.sbin/tcpdump
# make depend && make all install

3) FreeBSD 4.3-RELEASE systems:

An experimental upgrade package is available for users who wish to
provide testing and feedback on the binary upgrade process.  This
package may be installed on FreeBSD 4.3-RELEASE systems only, and is
intended for use on systems for which source patching is not practical
or convenient.

If you use the upgrade package, feedback (positive or negative) is
requested to security-officer@FreeBSD.org so we can improve the
process for future advisories.

During the installation procedure, backup copies are made of the files
which are replaced by the package.  These backup copies will be
reinstalled if the package is removed, reverting the system to a
pre-patched state.

Two versions of the upgrade package are available, depending on
whether or not the system has openssl installed.  To verify whether
your system has openssl installed, perform the following command:

# ls /usr/bin/openssl

Possible responses:

/usr/bin/openssl       # This response indicates you have openssl present

ls: /usr/bin/openssl: No such file or directory
                       # This reponse indicates you do not have
                       # openssl present

3a) If OpenSSL is not present

# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/packages/SA-01:48/security-patch-tcpdump-nossl-01.48.tgz
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/packages/SA-01:48/security-patch-tcpdump-nossl-01.48.tgz.asc

Verify the detached PGP signature using your PGP utility.

# pkg_add security-patch-tcpdump-nossl-01.48.tgz

3b) If OpenSSL is present

# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/packages/SA-01:48/security-patch-tcpdump-ssl-01.48.tgz
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/packages/SA-01:48/security-patch-tcpdump-ssl-01.48.tgz.asc

Verify the detached PGP signature using your PGP utility.

# pkg_add security-patch-tcpdump-ssl-01.48.tgz

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org

iQCVAwUBO1R5i1UuHi5z0oilAQFdCQQAhFUzYA7plZN1O0rK/iU/jPaoCqM0KDPP
Vdg+3zP8I5Vovdbxdns1DVefI3PVhZbLwh8E0ZnEz544FB5atiYsRiqQxuoEMZiN
1JSRHUOIYyAChtIUZY1JV9eF8GfemWaAcgNp7mNWYKl7dUn0nYERfTO92YNm+l7M
3nNvOwkhqLU=
=PrXC
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

	http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:	(07) 3365 7031
Telephone:	(07) 3365 4417 (International: +61 7 3365 4417)
		AusCERT personnel answer during Queensland business hours
		which are GMT+10:00 (AEST).
		On call after hours for emergencies.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBO1VpMSh9+71yA2DNAQE0lgP/Y5G/q3mwf8BnbUfqr/lIYyj8Y1RNYdmF
4XBPtkhMfs3mE6FFGVgCCmB+lyRKKmTUE01CX031GcLA8KJ0CKoBI1Q2HlKu5Ajw
/IDEP3vb91IMKQtT8K4DeV4EtQm6hJoVf0YI8Df9FsHcP3BSqR+l4M81gc0fHheg
FFE3iboFcnU=
=OnaW
-----END PGP SIGNATURE-----