RHBA-2009:1605 - Bug Fix Advisory

Topic

Updated tcpdump packages that fix two bugs are now available for Red Hat
Enterprise Linux 5.

[Updated 7 April 2010]
These packages have also been made available in the following child channels:
Red Hat Enterprise Linux Desktop Client 5 for x86, and Red Hat Desktop
Workstation Client 5 for x86. No changes have been made to the packages.

Description

The tcpdump tool is a command line utility for monitoring network traffic.

These updated packages resolve the following issues:

• when run on 64-bit architectures, tcpslice read the timestamps in pcap

files as 64-bit values despite them always been stored as 32-bit.
Consequently, rather than extracting packet-trace file portions as
expected, tcpslice returned a "couldn't find final packet in file" error.
With this update tcpslice reads pcap timestamps as 32-bit values and now
works as expected on 64-bit architectures. (BZ#485670)

• running "tcpdump -i [n]", where [n] was an invalid interface index,

caused tcpdump to SEGFAULT rather than return an "Invalid adapter index"
error. tcpdump now explicitly checks for the last entry in the device list.
If the [n] specified is higher than this entry, it returns "Invalid adapter
index" as expected and does not crash. (BZ#497819)

All tcpdump users should upgrade to these updated packages, which resolve
these issues.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 485670 - tcpslice doesn't work on x86_64 on RHEL5
• BZ - 497819 - tcpdump segfaults when passing invalid interface number

CVEs

(none)

References

(none)