Synopsis

Moderate: tcpdump security and bug fix update

Type/Severity

Security Advisory: Moderate

Topic

Updated tcpdump packages that fix a security issue and functionality bugs
are now available.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

Tcpdump is a command line tool for monitoring network traffic.

Moritz Jodeit discovered a denial of service bug in the tcpdump IEEE
802.11 processing code. An attacker could inject a carefully crafted frame
onto the IEEE 802.11 network that could crash a running tcpdump session if
a certain link type was explicitly specified. (CVE-2007-1218)

An integer overflow flaw was found in tcpdump's BGP processing code. An
attacker could execute arbitrary code with the privilege of the pcap user
by injecting a crafted frame onto the network. (CVE-2007-3798)

In addition, the following bugs have been addressed:

• if called with -C and -W switches, tcpdump would create the first
  savefile with the privileges of the user that executed tcpdump (usually
  root), rather than with ones of the pcap user. This could result in the
  inability to save the complete traffic log file properly without the
  immediate notice of the user running tcpdump.
  
• the arpwatch service initialization script would exit prematurely,
  returning a successful exit status incorrectly and preventing the status
  command from running in case networking is not available.
  

Users of tcpdump are advised to upgrade to these erratum packages, which
contain backported patches that correct these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 214377 - tcpdump gives 'permission denied' at 2nd file when dumping to >1 file
• BZ - 232519 - CVE-2007-1218 tcpdump denial of service
• BZ - 250275 - CVE-2007-3798 tcpdump BGP integer overflow

CVEs

• CVE-2007-3798
• CVE-2007-1218

References

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 4

SRPM
tcpdump-3.8.2-12.el4.src.rpm	SHA-256: 2d826acb873f1487c082a0f0ab776775dd17784ab657800841afcf7717a3588d
x86_64
arpwatch-2.1a13-12.el4.x86_64.rpm	SHA-256: eaad6e18ff8e5d7fb559ce26c203ad5a2ec46d28504bf64c094eb3ce2da0161f
arpwatch-2.1a13-12.el4.x86_64.rpm	SHA-256: eaad6e18ff8e5d7fb559ce26c203ad5a2ec46d28504bf64c094eb3ce2da0161f
libpcap-0.8.3-12.el4.i386.rpm	SHA-256: 011e365be2d163e9539c7cc743ca98fdd228617fb81552a57fd5a0ee5d164cdd
libpcap-0.8.3-12.el4.i386.rpm	SHA-256: 011e365be2d163e9539c7cc743ca98fdd228617fb81552a57fd5a0ee5d164cdd
libpcap-0.8.3-12.el4.x86_64.rpm	SHA-256: e6135cf8b9a4c81d28fc3840b0e54f607c07e9821d97dd5ffd08c54c18fea5d1
libpcap-0.8.3-12.el4.x86_64.rpm	SHA-256: e6135cf8b9a4c81d28fc3840b0e54f607c07e9821d97dd5ffd08c54c18fea5d1
tcpdump-3.8.2-12.el4.x86_64.rpm	SHA-256: 4eef60a362cffbe6b1f17db18aaa66cc99a6e9a19777bf5b14cda7edd49dada8
tcpdump-3.8.2-12.el4.x86_64.rpm	SHA-256: 4eef60a362cffbe6b1f17db18aaa66cc99a6e9a19777bf5b14cda7edd49dada8
ia64
arpwatch-2.1a13-12.el4.ia64.rpm	SHA-256: 057bb4e6be2255bc7b2f4b8e215e29e90f86c1b7a6f45640e1e165f0fb2131d5
arpwatch-2.1a13-12.el4.ia64.rpm	SHA-256: 057bb4e6be2255bc7b2f4b8e215e29e90f86c1b7a6f45640e1e165f0fb2131d5
libpcap-0.8.3-12.el4.i386.rpm	SHA-256: 011e365be2d163e9539c7cc743ca98fdd228617fb81552a57fd5a0ee5d164cdd
libpcap-0.8.3-12.el4.i386.rpm	SHA-256: 011e365be2d163e9539c7cc743ca98fdd228617fb81552a57fd5a0ee5d164cdd
libpcap-0.8.3-12.el4.ia64.rpm	SHA-256: 7e868d39eef8cf42f06b9c238f5b0bf1188eccef93d374b0138e05030025c01c
libpcap-0.8.3-12.el4.ia64.rpm	SHA-256: 7e868d39eef8cf42f06b9c238f5b0bf1188eccef93d374b0138e05030025c01c
tcpdump-3.8.2-12.el4.ia64.rpm	SHA-256: d6d1807784047bf9c3e28352f71893bd39a0010908869bca5d149eb4cb0c0ae4
tcpdump-3.8.2-12.el4.ia64.rpm	SHA-256: d6d1807784047bf9c3e28352f71893bd39a0010908869bca5d149eb4cb0c0ae4
i386
arpwatch-2.1a13-12.el4.i386.rpm	SHA-256: b837b4a8d12bb7d689def346184a544f69ee3110625150a6c8349d908d0df81c
arpwatch-2.1a13-12.el4.i386.rpm	SHA-256: b837b4a8d12bb7d689def346184a544f69ee3110625150a6c8349d908d0df81c
libpcap-0.8.3-12.el4.i386.rpm	SHA-256: 011e365be2d163e9539c7cc743ca98fdd228617fb81552a57fd5a0ee5d164cdd
libpcap-0.8.3-12.el4.i386.rpm	SHA-256: 011e365be2d163e9539c7cc743ca98fdd228617fb81552a57fd5a0ee5d164cdd
tcpdump-3.8.2-12.el4.i386.rpm	SHA-256: d00a87e395fbc08125f2df6e4344589113e48ac4569b4bea7f85ac6df2eca618
tcpdump-3.8.2-12.el4.i386.rpm	SHA-256: d00a87e395fbc08125f2df6e4344589113e48ac4569b4bea7f85ac6df2eca618

Red Hat Enterprise Linux Workstation 4

SRPM
tcpdump-3.8.2-12.el4.src.rpm	SHA-256: 2d826acb873f1487c082a0f0ab776775dd17784ab657800841afcf7717a3588d
x86_64
arpwatch-2.1a13-12.el4.x86_64.rpm	SHA-256: eaad6e18ff8e5d7fb559ce26c203ad5a2ec46d28504bf64c094eb3ce2da0161f
libpcap-0.8.3-12.el4.i386.rpm	SHA-256: 011e365be2d163e9539c7cc743ca98fdd228617fb81552a57fd5a0ee5d164cdd
libpcap-0.8.3-12.el4.x86_64.rpm	SHA-256: e6135cf8b9a4c81d28fc3840b0e54f607c07e9821d97dd5ffd08c54c18fea5d1
tcpdump-3.8.2-12.el4.x86_64.rpm	SHA-256: 4eef60a362cffbe6b1f17db18aaa66cc99a6e9a19777bf5b14cda7edd49dada8
ia64
arpwatch-2.1a13-12.el4.ia64.rpm	SHA-256: 057bb4e6be2255bc7b2f4b8e215e29e90f86c1b7a6f45640e1e165f0fb2131d5
libpcap-0.8.3-12.el4.i386.rpm	SHA-256: 011e365be2d163e9539c7cc743ca98fdd228617fb81552a57fd5a0ee5d164cdd
libpcap-0.8.3-12.el4.ia64.rpm	SHA-256: 7e868d39eef8cf42f06b9c238f5b0bf1188eccef93d374b0138e05030025c01c
tcpdump-3.8.2-12.el4.ia64.rpm	SHA-256: d6d1807784047bf9c3e28352f71893bd39a0010908869bca5d149eb4cb0c0ae4
i386
arpwatch-2.1a13-12.el4.i386.rpm	SHA-256: b837b4a8d12bb7d689def346184a544f69ee3110625150a6c8349d908d0df81c
libpcap-0.8.3-12.el4.i386.rpm	SHA-256: 011e365be2d163e9539c7cc743ca98fdd228617fb81552a57fd5a0ee5d164cdd
tcpdump-3.8.2-12.el4.i386.rpm	SHA-256: d00a87e395fbc08125f2df6e4344589113e48ac4569b4bea7f85ac6df2eca618

Red Hat Enterprise Linux Desktop 4

SRPM
tcpdump-3.8.2-12.el4.src.rpm	SHA-256: 2d826acb873f1487c082a0f0ab776775dd17784ab657800841afcf7717a3588d
x86_64
arpwatch-2.1a13-12.el4.x86_64.rpm	SHA-256: eaad6e18ff8e5d7fb559ce26c203ad5a2ec46d28504bf64c094eb3ce2da0161f
libpcap-0.8.3-12.el4.i386.rpm	SHA-256: 011e365be2d163e9539c7cc743ca98fdd228617fb81552a57fd5a0ee5d164cdd
libpcap-0.8.3-12.el4.x86_64.rpm	SHA-256: e6135cf8b9a4c81d28fc3840b0e54f607c07e9821d97dd5ffd08c54c18fea5d1
tcpdump-3.8.2-12.el4.x86_64.rpm	SHA-256: 4eef60a362cffbe6b1f17db18aaa66cc99a6e9a19777bf5b14cda7edd49dada8
i386
arpwatch-2.1a13-12.el4.i386.rpm	SHA-256: b837b4a8d12bb7d689def346184a544f69ee3110625150a6c8349d908d0df81c
libpcap-0.8.3-12.el4.i386.rpm	SHA-256: 011e365be2d163e9539c7cc743ca98fdd228617fb81552a57fd5a0ee5d164cdd
tcpdump-3.8.2-12.el4.i386.rpm	SHA-256: d00a87e395fbc08125f2df6e4344589113e48ac4569b4bea7f85ac6df2eca618

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
tcpdump-3.8.2-12.el4.src.rpm	SHA-256: 2d826acb873f1487c082a0f0ab776775dd17784ab657800841afcf7717a3588d
s390x
arpwatch-2.1a13-12.el4.s390x.rpm	SHA-256: f3a80db045918739534199503f82b71a72268a79f9c506deeb879b71356489cb
libpcap-0.8.3-12.el4.s390.rpm	SHA-256: 550844786b453d78d8f232eb307f93ee24561c72a288163497f7c31c78a0a024
libpcap-0.8.3-12.el4.s390x.rpm	SHA-256: 381800a66296b10e500dbc9a4f2515738ae91a736373131fc5f43a706cb419a2
tcpdump-3.8.2-12.el4.s390x.rpm	SHA-256: b13c88046c449ab4d9b4fe7df035a64ac36739589fc84fdbee795a1da3e5dbf7
s390
arpwatch-2.1a13-12.el4.s390.rpm	SHA-256: ed98eb2f04e36bf53e7baefa973806336df5eabd6546a6e66e0beb6f81fe63aa
libpcap-0.8.3-12.el4.s390.rpm	SHA-256: 550844786b453d78d8f232eb307f93ee24561c72a288163497f7c31c78a0a024
tcpdump-3.8.2-12.el4.s390.rpm	SHA-256: 513e16d87e4046218c043667be48f448759b659c5ec1f50a0ef124621d102c0c

Red Hat Enterprise Linux for Power, big endian 4

SRPM
tcpdump-3.8.2-12.el4.src.rpm	SHA-256: 2d826acb873f1487c082a0f0ab776775dd17784ab657800841afcf7717a3588d
ppc
arpwatch-2.1a13-12.el4.ppc.rpm	SHA-256: 3c54d3dc8bd2cdd16ff5824122c58702442b35d84b2fd49db3e51708d9220be0
libpcap-0.8.3-12.el4.ppc.rpm	SHA-256: b9777637397765ff79f8fd78d961f407d85078384f6e39ed5bad2e306cc1f770
libpcap-0.8.3-12.el4.ppc64.rpm	SHA-256: c660a28302b991fb31b70f74ce7bf1141b76b3b9bb236987ca057b31b1b3772a
tcpdump-3.8.2-12.el4.ppc.rpm	SHA-256: 7b568858d9272544c39453054805e4fc8644d77af3d6b253a191e30b75cdabd2