tcpdump ISAKMP parsing denial of service

tcpdump-isakmp-dos (11434) The risk level is classified as MediumMedium Risk

Description:

The tcpdump utility is vulnerable to a denial of service attack, caused by improper parsing of ISAKMP packets. A remote attacker could send malformed ISAKMP packets to UDP port 500 to cause tcpdump to enter into an infinite loop and become unresponsive. The application must be restarted to regain normal functionality.


Consequences:

Denial of Service

Remedy:

Upgrade to the latest version of tcpdump (0.7.2 or later), available from the tcpdump Web site. See References.

For Debian GNU/Linux 3.0 (woody):
Upgrade to the latest tcpdump package (3.6.2-2.3 or later), as listed in DSA-255-1 for more information. See References.

For Mandrake-Linux:
Upgrade to the latest cpdump package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2003:027 for more information. See References.

Mandrake Linux 8.1, 8.2, 9.0, Multi Network Firewall 8.2 and Corporate Server 2.1: 3.7.2-1.1mdk or later
Mandrake Single Network Firewall 7.2: 3.7.2-0.1mdk or later

For OpenPKG:
Upgrade to the latest tcpdump package, as listed below. Refer to OpenPKG Security Advisory OpenPKG-SA-2004.002 for more information. See References.

OpenPKG 1.2: 3.7.1-1.2.2 or later
OpenPKG 1.3: 3.7.2-1.3.1 or later
OpenPKG CURRENT: 2.6.10-20031211 or later

For Gentoo Linux:
Upgrade to the latest version of tcpdump (3.7.2 or later), as listed in Gentoo Linux Security Announcement 200303-5. See References.

For SuSE Linux:
Upgrade to the latest tcpdump package, as listed below. Refer to SuSE Security Announcement SuSE-SA:2003:0015 for more information. See References.

SuSE Linux 8.1 (Intel): 3.7.1-198 or later
SuSE Linux 8.0 (Intel): 3.6.2-322 or later
SuSE Linux 7.3 (Intel): 3.6.2-321 or later
SuSE Linux 7.3 (Sparc): 3.6.2-65 or later
SuSE Linux 7.3 (PPC): 3.6.2-207 or later
SuSE Linux 7.2 (Intel): 3.4a6-376 or later
SuSE Linux 7.1 (Intel): 3.4a6-375 or later
SuSE Linux 7.1 (AXP): 3.4a6-329 or later
SuSE Linux 7.1 (PPC): 3.4a6-317 or later

For Conectiva Linux:
Upgrade to the latest tcpdump package, as listed below. Refer to Conectiva Linux Security Announcement CLSA-2003:629 for more information. See References.

Conectiva Linux 6.0: 3.6.2-1U60_3cl or later
Conectiva Linux 7.0: 3.6.2-1U70_3cl or later
Conectiva Linux 8.0: 3.6.2-3U80_3cl or later

For Red Hat Linux:
Upgrade to the latest tcpdump package, as listed below. Refer to RHSA-2003:032-12 for more information. See References.

Red Hat 7.1: 3.6.3-17.7.1.2 or later
Red Hat 7.2: 3.6.3-17.7.2.2 or later
Red Hat 7.3: 3.6.3-17.7.3.2 or later
Red Hat 8.0: 3.6.3-17.8.0.2 or later

For other distributions:
Contact your vendor for upgrade or patch information.

References:

Platforms Affected:

  • Conectiva Linux 6.0
  • Conectiva Linux 7.0
  • Conectiva Linux 8.0
  • Debian Debian Linux 3.0
  • FreeBSD FreeBSD
  • Gentoo Linux
  • MandrakeSoft Mandrake Linux 8.1 IA64
  • MandrakeSoft Mandrake Linux 8.1
  • MandrakeSoft Mandrake Linux 8.2 PPC
  • MandrakeSoft Mandrake Linux 8.2
  • MandrakeSoft Mandrake Linux 9.0
  • MandrakeSoft Mandrake Linux Corporate Server 2.1
  • MandrakeSoft Mandrake Multi Network Firewall 8.2
  • MandrakeSoft Mandrake Single Network Firewall 7.2
  • Novell SuSE Linux Enterprise Server 7.0
  • OpenPKG OpenPKG 1.1
  • OpenPKG OpenPKG 1.2
  • OpenPKG OpenPKG 1.3
  • OpenPKG OpenPKG CURRENT
  • RedHat Enterprise Linux 2.1 ES
  • RedHat Enterprise Linux 2.1 AS
  • RedHat Enterprise Linux 2.1 WS
  • RedHat Linux 7.1
  • RedHat Linux 7.1 for iSeries
  • RedHat Linux 7.1 for pSeries
  • RedHat Linux 7.2
  • RedHat Linux 7.3
  • RedHat Linux 8.0
  • RedHat Linux Advanced Workstation 2.1 Itanium
  • Seth Webster tcpdump 3.6.3
  • Seth Webster tcpdump 3.7.1
  • SuSE Linux Enterprise Server 8
  • SuSE SuSE eMail Server 3.1
  • SuSE SuSE eMail Server III
  • SUSE SuSE Linux 7.1
  • SUSE SuSE Linux 7.2
  • SUSE SuSE Linux 7.3
  • SUSE SuSE Linux 8.0
  • SUSE SuSE Linux 8.1
  • SuSE SuSE Linux Connectivity Server
  • SuSE SuSE Linux Database Server
  • SuSE SuSE Linux Firewall
  • SuSE SuSE Linux Office Server
  • Turbolinux Turbolinux 7 Server
  • Turbolinux Turbolinux 7 Workstation
  • Turbolinux Turbolinux 8 Server
  • Turbolinux Turbolinux 8 Workstation
  • Turbolinux Turbolinux Advanced Server 6
  • Turbolinux Turbolinux Server 6.1
  • Turbolinux Turbolinux Server 6.5
  • Turbolinux Turbolinux Workstation 6.0

Reported:

Feb 27, 2003

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email ignore thisxforceignore this@ignore thisus.ignore thisibm.comignore this

Return to the main page