3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
130 lines
4.5 KiB
Text
130 lines
4.5 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-01:48 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: tcpdump contains remote buffer overflow
|
|
|
|
Category: core
|
|
Module: tcpdump
|
|
Announced: 2001-07-17
|
|
Credits: Nick Cleaton <nick@cleaton.net>
|
|
Affects: All releases of FreeBSD 4.x prior to 4.4,
|
|
FreeBSD 4.3-STABLE prior to the correction date
|
|
FreeBSD 3.x is unaffected.
|
|
Corrected: 2001-07-09
|
|
Vendor status: Patch released
|
|
FreeBSD only: NO
|
|
|
|
I. Background
|
|
|
|
tcpdump is a tool for monitoring network traffic activity.
|
|
|
|
II. Problem Description
|
|
|
|
An overflowable buffer was found in the version of tcpdump included
|
|
with FreeBSD 4.x. Due to incorrect string length handling in the
|
|
decoding of AFS RPC packets, a remote user may be able to overflow a
|
|
buffer causing the local tcpdump process to crash. In addition, it
|
|
may be possible to execute arbitrary code with the privileges of the
|
|
user running tcpdump, often root.
|
|
|
|
The effects of this vulnerability are similiar to those described in
|
|
advisory FreeBSD-SA-00:61.tcpdump.v1.1.
|
|
|
|
All released versions of FreeBSD prior to the correction date
|
|
including 4.3-RELEASE are vulnerable to this problem, however it does
|
|
not affect the FreeBSD 3.x branch which includes an older version of
|
|
tcpdump.
|
|
|
|
III. Impact
|
|
|
|
Remote users can cause the local tcpdump process to crash, and may be
|
|
able to cause arbitrary code to be executed as the user running
|
|
tcpdump, often root.
|
|
|
|
IV. Workaround
|
|
|
|
Do not use vulnerable versions of tcpdump in network environments
|
|
which may contain packets from untrusted sources.
|
|
|
|
V. Solution
|
|
|
|
One of the following:
|
|
|
|
1) Upgrade your vulnerable FreeBSD system to 4.3-STABLE or the
|
|
RELENG_4_3 security branch after the respective correction dates.
|
|
|
|
2) FreeBSD 4.x systems prior to the correction date:
|
|
|
|
Download the patch and the detached PGP signature from the following
|
|
locations, and verify the signature using your PGP utility.
|
|
|
|
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:48/tcpdump-4.x.patch
|
|
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:48/tcpdump-4.x.patch.asc
|
|
|
|
# cd /usr/src/contrib/tcpdump
|
|
# patch -p < /path/to/patch
|
|
# cd /usr/src/usr.sbin/tcpdump
|
|
# make depend && make all install
|
|
|
|
3) FreeBSD 4.3-RELEASE systems:
|
|
|
|
An experimental upgrade package is available for users who wish to
|
|
provide testing and feedback on the binary upgrade process. This
|
|
package may be installed on FreeBSD 4.3-RELEASE systems only, and is
|
|
intended for use on systems for which source patching is not practical
|
|
or convenient.
|
|
|
|
If you use the upgrade package, feedback (positive or negative) is
|
|
requested to security-officer@FreeBSD.org so we can improve the
|
|
process for future advisories.
|
|
|
|
During the installation procedure, backup copies are made of the files
|
|
which are replaced by the package. These backup copies will be
|
|
reinstalled if the package is removed, reverting the system to a
|
|
pre-patched state.
|
|
|
|
Two versions of the upgrade package are available, depending on
|
|
whether or not the system has openssl installed. To verify whether
|
|
your system has openssl installed, perform the following command:
|
|
|
|
# ls /usr/bin/openssl
|
|
|
|
Possible responses:
|
|
|
|
/usr/bin/openssl # This response indicates you have openssl present
|
|
|
|
ls: /usr/bin/openssl: No such file or directory
|
|
# This reponse indicates you do not have
|
|
# openssl present
|
|
|
|
3a) If OpenSSL is not present
|
|
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/packages/SA-01:48/security-patch-tcpdump-nossl-01.48.tgz
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/packages/SA-01:48/security-patch-tcpdump-nossl-01.48.tgz.asc
|
|
|
|
Verify the detached PGP signature using your PGP utility.
|
|
|
|
# pkg_add security-patch-tcpdump-nossl-01.48.tgz
|
|
|
|
3b) If OpenSSL is present
|
|
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/packages/SA-01:48/security-patch-tcpdump-ssl-01.48.tgz
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/packages/SA-01:48/security-patch-tcpdump-ssl-01.48.tgz.asc
|
|
|
|
Verify the detached PGP signature using your PGP utility.
|
|
|
|
# pkg_add security-patch-tcpdump-ssl-01.48.tgz
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.0.6 (FreeBSD)
|
|
Comment: For info see http://www.gnupg.org
|
|
|
|
iQCVAwUBO1R5i1UuHi5z0oilAQFdCQQAhFUzYA7plZN1O0rK/iU/jPaoCqM0KDPP
|
|
Vdg+3zP8I5Vovdbxdns1DVefI3PVhZbLwh8E0ZnEz544FB5atiYsRiqQxuoEMZiN
|
|
1JSRHUOIYyAChtIUZY1JV9eF8GfemWaAcgNp7mNWYKl7dUn0nYERfTO92YNm+l7M
|
|
3nNvOwkhqLU=
|
|
=PrXC
|
|
-----END PGP SIGNATURE-----
|