libpcap and tcpdump downloads could contain a backdoor
| libpcap-tcpdump-backdoor (10620) |  High Risk |
Description:
The libpcap and tcpdump tools, if downloaded from (www.tcpdump.org) or libpcap and tcpdump mirrored FTP sites between 11-Nov-2002 and 13-Nov-2002, could cause a backdoor to be installed on victim's computers. One of the Web site's hosting these tools (www.tcpdump.org) was compromised on or before 11-Nov-2002 and the libpcap-0.7.1.tar.gz, tcpdump-3.6.2.tar.gz, and tcpdump-3.7.1.tar.gz files were modified to include a Trojan Horse. This could allow a remote attacker to gain access to systems that have installed the compromised libpcap and tcpdump distributions and execute commands on the system with privileges of the user who installed the affected packages.
Consequences:
Gain Access
Remedy:
Users should verify that they have an authentic version of libpcap or tcpdump installed. Refer to CERT Advisory CA-2002-30 for more information. See References.
References:
- BugTraq Mailing List, 2002-11-13 14:48:30: Latest libpcap & tcpdump sources from tcpdump.org contain a trojan.
- CERT Advisory CA-2002-30 : Trojan Horse tcpdump and libpcap Distributions.
- CIAC Information Bulletin N-014: Trojan Horse tcpdump and libpcap Distributions.
- BID-6171: TCPDump / LIBPCap Trojan Horse Vulnerability
- CVE-1999-0660: A hacker utility, back door, or Trojan Horse is installed on a system, e.g. NetBus, Back Orifice, Rootkit, etc.
Platforms Affected:
- Seth Webster tcpdump 3.6.2
- Seth Webster tcpdump 3.7.1
- Various vendors libcap 0.7.1
Reported:
Nov 13, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net