[Full-Disclosure] GLSA: tcpdump (200303-5)

From: Daniel Ahlberg (aliz@gentoo.org)
Date: 03/05/03

  • Next message: Maarten Hartsuijker: "[Full-Disclosure] shopfactory shopping cart" 
    From: Daniel Ahlberg <aliz@gentoo.org>
To: full-disclosure@lists.netsys.com
Date: Wed, 5 Mar 2003 11:20:05 +0100

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - - ---------------------------------------------------------------------
    GENTOO LINUX SECURITY ANNOUNCEMENT 200303-5
    - - ---------------------------------------------------------------------

              PACKAGE : tcpdump
              SUMMARY : remote dos
                 DATE : 2003-03-05 10:19 UTC
              EXPLOIT : remote
    VERSIONS AFFECTED : <3.7.2
        FIXED VERSION : =>3.7.2
                  CVE : CAN-2003-0108

    - - ---------------------------------------------------------------------

    - From advisory:

    "A vulnerability exists in the parsing of ISAKMP packets (UDP port 500)
    that allows an attacker to force TCPDUMP into an infinite loop upon
    receipt of a specially crafted packet."

    Read the full advisory at:
    http://www.idefense.com/advisory/02.27.03.txt

    SOLUTION

    It is recommended that all Gentoo Linux users who are running
    net-analyzer/tcpdump upgrade to tcpdump-3.7.2 as follows:

    emerge sync
    emerge -u tcpdump
    emerge clean

    - - ---------------------------------------------------------------------
    aliz@gentoo.org - GnuPG key is available at http://cvs.gentoo.org/~aliz
    - - ---------------------------------------------------------------------
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.1 (GNU/Linux)

    iD8DBQE+Zc9LfT7nyhUpoZMRAhvzAJ4nvljUMlxZ3apC4IHsgW82ac7IdQCghAJ+
    1A8EmkbKOczX+avWHCEudKY=
    =YQs3
    -----END PGP SIGNATURE-----
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Maarten Hartsuijker: "[Full-Disclosure] shopfactory shopping cart"

    Relevant Pages

    • GLSA: tcpdump (200303-5)
      ... "A vulnerability exists in the parsing of ISAKMP packets ... Read the full advisory at: ... It is recommended that all Gentoo Linux users who are running ... emerge -u tcpdump ...
      (Bugtraq)
    • [Full-Disclosure] GLSA: netscape-flash (200303-9)
      ... GENTOO LINUX SECURITY ANNOUNCEMENT 200303-9 ... Read the full advisory at: ... It is recommended that all Gentoo Linux users who are running ... emerge netscape-flash ...
      (Full-Disclosure)
    • [Full-Disclosure] GLSA: man (200303-13)
      ... Read the full advisory at: ... It is recommended that all Gentoo Linux users who are running ... emerge sync ...
      (Full-Disclosure)
    • GLSA: rxvt (200303-16)
      ... Read the full advisory at: ... It is recommended that all Gentoo Linux users who are running ... emerge sync ...
      (Bugtraq)
    • GLSA: eterm (200303-1)
      ... Read the full advisory at: ... It is recommended that all Gentoo Linux users who are running ... emerge -u eterm ...
      (Bugtraq)
    • Quantcast