=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=2D -----------------------------------------------------------------------
Fedora Legacy Update Advisory

Synopsis: Updated tcpdump resolves security vulnerability
Advisory ID: FLSA:1222
Issue date: 2004-01-31
Product: Red Hat Linux
Keywords: Security
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=3D1222
CVE Names: CAN-2003-0989, CAN-2004-0055, CAN-2004-0057
=2D -----------------------------------------------------------------------

1. Topic:

Updated tcpdump packages are now available that fix multiple security=20
vulnerabilities which may allow remote attackers to exploit these issues=20
by sending carefully-crafted packets to a victim. If the victim uses=20
tcpdump, these packets could result in a denial of service, or possibly=20
execute arbitrary code as the 'pcap' user.

2. Relevant releases/architectures:

Red Hat Linux 7.2 - i386
Red Hat Linux 7.3 - i386
Red Hat Linux 8.0 - i386

3. Problem description:

Tcpdump is a command-line tool for monitoring network traffic. Tcpdump can=
=20
capture and display the packet headers on a particular network interface=20
or on all interfaces. Tcpdump can display all of the packet headers, or=20
just the ones that match particular criteria.

George Bakos discovered flaws in the ISAKMP decoding routines of tcpdump=20
versions prior to 3.8.1. The Common Vulnerabilities and Exposures project=20
(cve.mitre.org) has assigned the name CAN-2003-0989 to this issue.

Jonathan Heusser discovered an additional flaw in the ISAKMP decoding=20
routines for tcpdump 3.8.1 and earlier. The Common Vulnerabilities and=20
Exposures project (cve.mitre.org) has assigned the name CAN-2004-0057 to=20
this issue.

Jonathan Heusser discovered a flaw in the print_attr_string function in the=
=20
RADIUS decoding routines for tcpdump 3.8.1 and earlier. The Common=20
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the=20
name CAN-2004-0055 to this issue.

Users of tcpdump should update to these update packages, which contain a=20
backported security patch that corrects this issue.

=46edora Legacy would like to thank George Bakos and Jonathan Heusser for=20
discovering and disclosing these issues, as well as Christian Pearce for=20
providing a backported fix for Red Hat Linux 7.2, 7.3, and 8.0.

4. Solution:

Before applying this update, make sure all previously released errata=20
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those=20
RPMs which are currently installed will be updated. Those RPMs which are=20
not installed but included in the list will not be updated. Note that you=
=20
can also use wildcards (*.rpm) if your current directory *only* contains=20
the desired RPMs.

Please note that this update is also available via yum and apt. Many=20
people find this an easier way to apply updates. To use yum issue:

yum update

or to use apt:

apt-get update; apt-get upgrade

This will start an interactive process that will result in the appropriate=
=20
RPMs being upgraded on your system. This assumes that you have yum or=20
apt-get configured for obtaining Fedora Legacy content. Please visit=20
http://www.fedoralegacy.org/download for directions on how to configure=20
yum and apt-get.

5. Bug IDs fixed:

http://bugzilla.fedora.us - 1222 - tcpdump security fix in rh7x, rh80

6. RPMs required:

Red Hat Linux 7.2:

SRPMS:
http://download.fedoralegacy.org/red...ump-3.6.3-17.=
7.2.4.legacy.src.rpm
i386:
http://download.fedoralegacy.org/red...mp-3.6.3-17.7=
=2E2.4.legacy.i386.rpm
http://download.fedoralegacy.org/red...ap-0.6.2-17.7=
=2E2.4.legacy.i386.rpm
http://download.fedoralegacy.org/red...tch-2.1a11-17=
=2E7.2.4.legacy.i386.rpm

Red Hat Linux 7.3:

SRPMS:
http://download.fedoralegacy.org/red...ump-3.6.3-17.=
7.3.4.legacy.src.rpm
i386:
http://download.fedoralegacy.org/red...mp-3.6.3-17.7=
=2E3.4.legacy.i386.rpm
http://download.fedoralegacy.org/red...ap-0.6.2-17.7=
=2E3.4.legacy.i386.rpm
http://download.fedoralegacy.org/red...tch-2.1a11-17=
=2E7.3.4.legacy.i386.rpm

Red Hat Linux 8.0:

SRPMS:
http://download.fedoralegacy.org/red...ump-3.6.3-17.=
8.0.5.legacy.src.rpm
i386:
http://download.fedoralegacy.org/red...mp-3.6.3-17.8=
=2E0.5.legacy.i386.rpm
http://download.fedoralegacy.org/red...ap-0.6.2-17.8=
=2E0.5.legacy.i386.rpm
http://download.fedoralegacy.org/red...tch-2.1a11-17=
=2E8.0.5.legacy.i386.rpm

7. Verification:

SHA1 sum Package Name
=2D -----------------------------------------------------------------------=
=2D---
a10c0d99cd919f459a25fdb5562d6907667b33d3 =20
7.2/updates/SRPMS/tcpdump-3.6.3-17.7.2.4.legacy.src.rpm
e3777ee05d6b57a81fa08a96b64aa45a0758e42f =20
7.2/updates/i386/tcpdump-3.6.3-17.7.2.4.legacy.i386.rpm
795dd99495f288aacea6a8775e9aba8eb801e570 =20
7.2/updates/i386/libpcap-0.6.2-17.7.2.4.legacy.i386.rpm
8e860cb231b7dd59345c2f82531d527ca78090b5 =20
7.2/updates/i386/arpwatch-2.1a11-17.7.2.4.legacy.i386.rpm
=20
3b7cb6c9f62c259e2c24d056263281a44a5ce406 =20
7.3/updates/SRPMS/tcpdump-3.6.3-17.7.3.4.legacy.src.rpm
cc1f3f75f7eb32a1ea2aa224cbae64190e5dcaf5 =20
7.3/updates/i386/tcpdump-3.6.3-17.7.3.4.legacy.i386.rpm
5aeb410a107e4b82d0f62c6f8931d20998a8e1de =20
7.3/updates/i386/libpcap-0.6.2-17.7.3.4.legacy.i386.rpm
7fbb66ee934dcb388489c94551c56ac74c3d0540 =20
7.3/updates/i386/arpwatch-2.1a11-17.7.3.4.legacy.i386.rpm
=20
c9e455ef10ea70f69e269f6d71c3ded700424ca1 =20
8.0/updates/SRPMS/tcpdump-3.6.3-17.8.0.5.legacy.src.rpm
cbb7cd725a50be1cbdbc8ee75a357229e847afac =20
8.0/updates/i386/tcpdump-3.6.3-17.8.0.5.legacy.i386.rpm
643931721424765748895f57f4ca53dba896378c =20
8.0/updates/i386/libpcap-0.6.2-17.8.0.5.legacy.i386.rpm
1f9aacbd480af1a754adc9d6190ddc06d2b491ab =20
8.0/updates/i386/arpwatch-2.1a11-17.8.0.5.legacy.i386.rpm

These packages are GPG signed by Fedora Legacy for security. Our key is=20
available from http://www.fedoralegacy.org/about/security.php

You can verify each package with the following command:

rpm --checksig -v <filename>

If you only wish to verify that each package has not been corrupted or=20
tampered with, examine only the sha1sum with the following command:

sha1sum <filename>

8. References:

http://cve.mitre.org/cgi-bin/cvename...DCAN-2003-0989
http://cve.mitre.org/cgi-bin/cvename...DCAN-2004-0055
http://cve.mitre.org/cgi-bin/cvename...DCAN-2004-0057
http://marc.theaimsgroup.com/?l=3Dtc...73018070&w=3D2
https://bugzilla.fedora.us/show_bug.cgi?id=3D1222

9. Contact:

The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More=20
project details at http://www.fedoralegacy.org

=2D --=20
Jesse Keating RHCE (http://geek.j2solutions.net)
=46edora Legacy Team (http://www.fedoralegacy.org)
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQFAHAFp4v2HLvE71NURAlGdAJ9B3QYtOyRf/8ovaVoCSqKWmWAdEgCfbyjP
c1idYfVI+kmtBpBfYzkxxJo=3D
=3DZuMs
=2D----END PGP SIGNATURE-----