Synopsis

libpcap bug fix and enhancement update

Type/Severity

Bug Fix Advisory

Topic

Updated libpcap packages that fix several bugs and add various enhancements are
now available for Red Hat Enterprise Linux 6.

Description

The Packet Capture library (pcap) provides a high level interface to packet
capture systems. All packets on the network, even those destined for other
hosts, are accessible through this mechanism. It also supports saving captured
packets to a 'savefile', and reading packets from a 'savefile'. libpcap provides
implementation-independent access to the underlying packet capture facility
provided by the operating system.

The libpcap packages have been upgraded to upstream version 1.4.1, which
provides a number of bug fixes and enhancements over the previous version.
(BZ#916749)

This update also fixes the following bugs:

• Previously, the libpcap library generated wrong filtering code for Berkeley

Packet Filter (BPF) infrastructure. As a consequence, the in-kernel packet
filter was discarding some packets which should have been received by userspace
process. Moreover, the tcpdump utility produced incorrect output when a
fragmentation of IPv6 packet occurred because of the MTUlink. To fix this bug,
the code which deals with BPF filter generation has been fixed to check for
fragmentation headers in IPv6 PDUs before checking for the final protocol. As a
result, the kernel filter no longer discards IPv6 fragments when source-site
fragmentation occurs during IPv6 transmission and tcpdump receives all packets.
(BZ#723108)

• Prior to this update, libpcap was unable to open a capture device with small

values of SnapLen, which caused libpcap to return an error code and tcpdump to
exit prematurely. Calculation of frames for memory mapping packet capture
mechanism has been adjusted not to truncate packets to smaller values than
actual SnapLen, thus fixing the bug. As a result, libpcap no longer returns
errors when trying to open a capture device with small values of SnapLen, and
applications using libpcap are able to process packets. (BZ#731789)

Users of libpcap are advised to upgrade to these updated packages, which fix
these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x

Fixes

• BZ - 723108 - tcpdump icmp6 option can't catch icmpv6 package larger than 1460
• BZ - 731789 - Bug with snaplen in libpcap

CVEs

(none)

References

(none)