tcpdump ISAKMP parsing denial of service
| tcpdump-isakmp-dos (11434) |  Low Risk |
Description:
The tcpdump utility is vulnerable to a denial of service attack, caused by improper parsing of ISAKMP packets. A remote attacker could send malformed ISAKMP packets to UDP port 500 to cause tcpdump to enter into an infinite loop and become unresponsive. The application must be restarted to regain normal functionality.
Platforms Affected:
- Conectiva, Linux 6.0
- Conectiva, Linux 7.0
- Conectiva, Linux 8.0
- Debian, Debian Linux 3.0
- FreeBSD, FreeBSD
- Gentoo, Linux
- MandrakeSoft, Mandrake Linux 8.1 IA64
- MandrakeSoft, Mandrake Linux 8.1
- MandrakeSoft, Mandrake Linux 8.2 PPC
- MandrakeSoft, Mandrake Linux 8.2
- MandrakeSoft, Mandrake Linux 9.0
- MandrakeSoft, Mandrake Linux Corporate Server 2.1
- MandrakeSoft, Mandrake Multi Network Firewall 8.2
- MandrakeSoft, Mandrake Single Network Firewall 7.2
- OpenPKG, OpenPKG 1.1
- OpenPKG, OpenPKG 1.2
- OpenPKG, OpenPKG 1.3
- OpenPKG, OpenPKG CURRENT
- RedHat, Enterprise Linux 2.1 WS
- RedHat, Enterprise Linux 2.1 ES
- RedHat, Enterprise Linux 2.1 AS
- RedHat, Linux 7.1
- RedHat, Linux 7.1 for iSeries
- RedHat, Linux 7.1 for pSeries
- RedHat, Linux 7.2
- RedHat, Linux 7.3
- RedHat, Linux 8.0
- RedHat, Linux Advanced Workstation 2.1 Itanium
- Seth Webster, tcpdump 3.6.3
- Seth Webster, tcpdump 3.7.1
- SuSE, SuSE eMail Server 3.1
- SuSE, SuSE eMail Server III
- SuSE, SuSE Linux 7.1
- SuSE, SuSE Linux 7.2
- SuSE, SuSE Linux 7.3
- SuSE, SuSE Linux 8.0
- SuSE, SuSE Linux 8.1
- SuSE, SuSE Linux Connectivity Server
- SuSE, SuSE Linux Database Server
- SuSE, SuSE Linux Enterprise Server 7.0
- SuSE, SuSE Linux Enterprise Server 8.0
- SuSE, SuSE Linux Firewall
- SuSE, SuSE Linux Office Server
- Turbolinux, Turbolinux 7 Server
- Turbolinux, Turbolinux 7 Workstation
- Turbolinux, Turbolinux 8 Server
- Turbolinux, Turbolinux 8 Workstation
- Turbolinux, Turbolinux Advanced Server 6
- Turbolinux, Turbolinux Server 6.1
- Turbolinux, Turbolinux Server 6.5
- Turbolinux, Turbolinux Workstation 6.0
Remedy:
Upgrade to the latest version of tcpdump (0.7.2 or later), available from the tcpdump Web site. See References.
For Debian GNU/Linux 3.0 (woody):
Upgrade to the latest tcpdump package (3.6.2-2.3 or later), as listed in DSA-255-1 for more information. See References.
For Mandrake-Linux:
Upgrade to the latest cpdump package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2003:027 for more information. See References.
Mandrake Linux 8.1, 8.2, 9.0, Multi Network Firewall 8.2 and Corporate Server 2.1: 3.7.2-1.1mdk or later
Mandrake Single Network Firewall 7.2: 3.7.2-0.1mdk or later
For OpenPKG:
Upgrade to the latest tcpdump package, as listed below. Refer to OpenPKG Security Advisory OpenPKG-SA-2004.002 for more information. See References.
OpenPKG 1.2: 3.7.1-1.2.2 or later
OpenPKG 1.3: 3.7.2-1.3.1 or later
OpenPKG CURRENT: 2.6.10-20031211 or later
For Gentoo Linux:
Upgrade to the latest version of tcpdump (3.7.2 or later), as listed in Gentoo Linux Security Announcement 200303-5. See References.
For SuSE Linux:
Upgrade to the latest tcpdump package, as listed below. Refer to SuSE Security Announcement SuSE-SA:2003:0015 for more information. See References.
SuSE Linux 8.1 (Intel): 3.7.1-198 or later
SuSE Linux 8.0 (Intel): 3.6.2-322 or later
SuSE Linux 7.3 (Intel): 3.6.2-321 or later
SuSE Linux 7.3 (Sparc): 3.6.2-65 or later
SuSE Linux 7.3 (PPC): 3.6.2-207 or later
SuSE Linux 7.2 (Intel): 3.4a6-376 or later
SuSE Linux 7.1 (Intel): 3.4a6-375 or later
SuSE Linux 7.1 (AXP): 3.4a6-329 or later
SuSE Linux 7.1 (PPC): 3.4a6-317 or later
For Conectiva Linux:
Upgrade to the latest tcpdump package, as listed below. Refer to Conectiva Linux Security Announcement CLSA-2003:629 for more information. See References.
Conectiva Linux 6.0: 3.6.2-1U60_3cl or later
Conectiva Linux 7.0: 3.6.2-1U70_3cl or later
Conectiva Linux 8.0: 3.6.2-3U80_3cl or later
For Red Hat Linux:
Upgrade to the latest tcpdump package, as listed below. Refer to RHSA-2003:032-12 for more information. See References.
Red Hat 7.1: 3.6.3-17.7.1.2 or later
Red Hat 7.2: 3.6.3-17.7.2.2 or later
Red Hat 7.3: 3.6.3-17.7.3.2 or later
Red Hat 8.0: 3.6.3-17.8.0.2 or later
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Denial of Service
References:
- Conectiva Linux Security Announcement CLSA-2003:629, tcpdump at http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000629.
- Gentoo Linux Security Announcement 200303-5, tcpdump -- remote dos at http://www.linuxsecurity.com/advisories/gentoo_advisory-2933.html.
- iDEFENSE Security Advisory 02.27.03, TCPDUMP Denial of Service Vulnerability in ISAKMP Packet Parsing at http://www.idefense.com/intelligence/vulnerabilities/display.php?id=19.
- tcpdump Web site, TCPDUMP public repository at http://www.tcpdump.org.
- tcpdump Web site, Index of /release at http://www.tcpdump.org/release/.
- BID-6974: TCPDump Malformed ISAKMP Packet Denial Of Service Vulnerability
- CVE-2003-0108: isakmp_sub_print in tcpdump 3.6 through 3.7.1 allows remote attackers to cause a denial of service (CPU consumption) via a certain malformed ISAKMP packet to UDP port 500, which causes tcpdump to enter an infinite loop.
- DSA-255: tcpdump -- infinite loop
- MDKSA-2003:027: Updated tcpdump packages fix denial of service vulnerabilities
- OpenPKG-SA-2003.014: tcpdump
- OpenPKG-SA-2004.002: tcpdump
- RHSA-2003-032: Updated tcpdump packages fix various vulnerabilities
- RHSA-2003-085: tcpdump security update
- RHSA-2003-214: Updated tcpdump packages fix various vulnerabilities
- SUSE-SA:2003:0015: tcpdump: remote system compromise
Reported:
Feb 27, 2003
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net