TCPDump Malformed NFS Packet Buffer Overflow Vulnerability

TCPDump Malformed NFS Packet Buffer Overflow Vulnerability

Solution:
HP has advised applying the corresponding fixes from Red Hat Advisory RHSA-2002:094.

FreeBSD has made a patch available. If it cannot be installed, administrators are advised to upgrade vulnerable systems to 4.6-STABLE; or to the RELENG_4_6, RELENG_4_5, or RELENG_4_4 security branch dated after the correction date in the advisory (4.6-RELEASE-p2, 4.5-RELEASE-p8, or 4.4-RELEASE-p15).

MandrakeSoft has released an advisory. Information about obtaining and applying fixes are available in the referenced advisory.

OpenPKG has released an advisory OpenPKG-SA-2004.002 to address this and other issues. Please see the referenced advisory for more information.

Upgrades/patches are available:

LBL tcpdump 3.6.2

Caldera tcpdump-3.6.2-2.i386.rpm
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS/ tcpdump-3.6.2-2.i386.rpm

Caldera tcpdump-3.6.2-2.i386.rpm
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/ RPMS/tcpdump-3.6.2-2.i386.rpm

Caldera tcpdump-3.6.2-2.i386.rpm
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS/tc pdump-3.6.2-2.i386.rpm

Caldera tcpdump-3.6.2-2.i386.rpm
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RP MS/tcpdump-3.6.2-2.i386.rpm

Caldera tcpdump-3.6.2-2.src.rpm
Source RPM.
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS /tcpdump-3.6.2-2.src.rpm

Caldera tcpdump-3.6.2-2.src.rpm
Source RPM.
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/ SRPMS/tcpdump-3.6.2-2.src.rpm

Caldera tcpdump-3.6.2-2.src.rpm
Source RPM.
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS/t cpdump-3.6.2-2.src.rpm

Caldera tcpdump-3.6.2-2.src.rpm
Source RPM.
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/SR PMS/tcpdump-3.6.2-2.src.rpm

Conectiva arpwatch-2.1a11-9U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/arpwatch-2.1a11-9U60_1cl. i386.rpm

Conectiva arpwatch-2.1a11-9U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/arpwatch-2.1a11-9U70_1cl. i386.rpm

Conectiva libpcap-0.6.2-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/libpcap-0.6.2-1U60_2cl.i3 86.rpm

Conectiva libpcap-0.6.2-1U70_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/libpcap-0.6.2-1U70_2cl.i3 86.rpm

Conectiva libpcap-devel-0.6.2-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/libpcap-devel-0.6.2-1U60_ 2cl.i386.rpm

Conectiva libpcap-devel-0.6.2-1U70_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/libpcap-devel-0.6.2-1U70_ 2cl.i386.rpm

Conectiva libpcap-devel-static-0.6.2-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/libpcap-devel-static-0.6. 2-1U60_2cl.i386.rpm

Conectiva libpcap-devel-static-0.6.2-1U70_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/libpcap-devel-static-0.6. 2-1U70_2cl.i386.rpm

Conectiva tcpdump-3.6.2-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/tcpdump-3.6.2-1U60_2cl.i3 86.rpm

Conectiva tcpdump-3.6.2-1U60_2cl.src.rpm
Source RPM.
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/tcpdump-3.6.2-1U60_2cl.s rc.rpm

Conectiva tcpdump-3.6.2-1U70_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/tcpdump-3.6.2-1U70_2cl.i3 86.rpm

Conectiva tcpdump-3.6.2-1U70_2cl.src.rpm
Source RPM.
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/tcpdump-3.6.2-1U70_2cl.s rc.rpm

Conectiva tcpdump-3.6.2-3U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/tcpdump-3.6.2-3U8_2cl.i386. rpm

Conectiva tcpdump-3.6.2-3U8_2cl.src.rpm
Source RPM.
ftp://atualizacoes.conectiva.com.br/8/SRPMS/tcpdump-3.6.2-3U8_2cl.src. rpm

Debian tcpdump_3.6.2-2.3_alpha.deb
http://security.debian.org/pool/updates/main/t/tcpdump/tcpdump_3.6.2-2 .3_alpha.deb

Debian tcpdump_3.6.2-2.3_arm.deb
http://security.debian.org/pool/updates/main/t/tcpdump/tcpdump_3.6.2-2 .3_arm.deb

Debian tcpdump_3.6.2-2.3_hppa.deb
http://security.debian.org/pool/updates/main/t/tcpdump/tcpdump_3.6.2-2 .3_hppa.deb

Debian tcpdump_3.6.2-2.3_i386.deb
http://security.debian.org/pool/updates/main/t/tcpdump/tcpdump_3.6.2-2 .3_i386.deb

Debian tcpdump_3.6.2-2.3_ia64.deb
http://security.debian.org/pool/updates/main/t/tcpdump/tcpdump_3.6.2-2 .3_ia64.deb

Debian tcpdump_3.6.2-2.3_m68k.deb
http://security.debian.org/pool/updates/main/t/tcpdump/tcpdump_3.6.2-2 .3_m68k.deb

Debian tcpdump_3.6.2-2.3_mips.deb
http://security.debian.org/pool/updates/main/t/tcpdump/tcpdump_3.6.2-2 .3_mips.deb

Debian tcpdump_3.6.2-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/t/tcpdump/tcpdump_3.6.2-2 .3_mipsel.deb

Debian tcpdump_3.6.2-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/t/tcpdump/tcpdump_3.6.2-2 .3_powerpc.deb

Debian tcpdump_3.6.2-2.3_s390.deb
http://security.debian.org/pool/updates/main/t/tcpdump/tcpdump_3.6.2-2 .3_s390.deb

Debian tcpdump_3.6.2-2.3_sparc.deb
http://security.debian.org/pool/updates/main/t/tcpdump/tcpdump_3.6.2-2 .3_sparc.deb

Red Hat arpwatch-2.1a11-11.6.2.0.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/arpwatch-2.1a11-11.6.2.0.alph a.rpm

Red Hat arpwatch-2.1a11-11.6.2.0.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/arpwatch-2.1a11-11.6.2.0.i386. rpm

Red Hat arpwatch-2.1a11-11.6.2.0.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/arpwatch-2.1a11-11.6.2.0.spar c.rpm

Red Hat arpwatch-2.1a11-11.7.0.0.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/arpwatch-2.1a11-11.7.0.0.alph a.rpm

Red Hat arpwatch-2.1a11-11.7.0.0.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/arpwatch-2.1a11-11.7.0.0.i386. rpm

Red Hat arpwatch-2.1a11-11.7.1.0.alpha.rpm
ftp://updates.redhat.com/7.1/en/os/alpha/arpwatch-2.1a11-11.7.1.0.alph a.rpm

Red Hat arpwatch-2.1a11-11.7.1.0.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/arpwatch-2.1a11-11.7.1.0.i386. rpm

Red Hat arpwatch-2.1a11-11.7.1.0.ia64.rpm
ftp://updates.redhat.com/7.1/en/os/ia64/arpwatch-2.1a11-11.7.1.0.ia64. rpm

Red Hat arpwatch-2.1a11-11.7.2.0.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/arpwatch-2.1a11-11.7.2.0.i386. rpm

Red Hat arpwatch-2.1a11-11.7.2.0.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/arpwatch-2.1a11-11.7.2.0.ia64. rpm

Red Hat libpcap-0.6.2-11.6.2.0.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/libpcap-0.6.2-11.6.2.0.alpha. rpm

Red Hat libpcap-0.6.2-11.6.2.0.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/libpcap-0.6.2-11.6.2.0.i386.rp m

Red Hat libpcap-0.6.2-11.6.2.0.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/libpcap-0.6.2-11.6.2.0.sparc. rpm

Red Hat libpcap-0.6.2-11.7.0.0.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/libpcap-0.6.2-11.7.0.0.alpha. rpm

Red Hat libpcap-0.6.2-11.7.0.0.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/libpcap-0.6.2-11.7.0.0.i386.rp m

Red Hat libpcap-0.6.2-11.7.1.0.alpha.rpm
ftp://updates.redhat.com/7.1/en/os/alpha/libpcap-0.6.2-11.7.1.0.alpha. rpm

Red Hat libpcap-0.6.2-11.7.1.0.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/libpcap-0.6.2-11.7.1.0.i386.rp m

Red Hat libpcap-0.6.2-11.7.1.0.ia64.rpm
ftp://updates.redhat.com/7.1/en/os/ia64/libpcap-0.6.2-11.7.1.0.ia64.rp m

Red Hat libpcap-0.6.2-11.7.2.0.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/libpcap-0.6.2-11.7.2.0.i386.rp m

Red Hat libpcap-0.6.2-11.7.2.0.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/libpcap-0.6.2-11.7.2.0.ia64.rp m

Red Hat tcpdump-3.6.2-11.6.2.0.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/tcpdump-3.6.2-11.6.2.0.alpha. rpm

Red Hat tcpdump-3.6.2-11.6.2.0.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/tcpdump-3.6.2-11.6.2.0.i386.rp m

Red Hat tcpdump-3.6.2-11.6.2.0.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/tcpdump-3.6.2-11.6.2.0.sparc. rpm

Red Hat tcpdump-3.6.2-11.6.2.0.src.rpm
Source RPM.
ftp://updates.redhat.com/6.2/en/os/SRPMS/tcpdump-3.6.2-11.6.2.0.src.rp m

Red Hat tcpdump-3.6.2-11.7.0.0.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/tcpdump-3.6.2-11.7.0.0.alpha. rpm

Red Hat tcpdump-3.6.2-11.7.0.0.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/tcpdump-3.6.2-11.7.0.0.i386.rp m

Red Hat tcpdump-3.6.2-11.7.0.0.src.rpm
Source RPM.
ftp://updates.redhat.com/7.0/en/os/SRPMS/tcpdump-3.6.2-11.7.0.0.src.rp m

Red Hat tcpdump-3.6.2-11.7.1.0.alpha.rpm
ftp://updates.redhat.com/7.1/en/os/alpha/tcpdump-3.6.2-11.7.1.0.alpha. rpm

Red Hat tcpdump-3.6.2-11.7.1.0.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/tcpdump-3.6.2-11.7.1.0.i386.rp m

Red Hat tcpdump-3.6.2-11.7.1.0.ia64.rpm
ftp://updates.redhat.com/7.1/en/os/ia64/tcpdump-3.6.2-11.7.1.0.ia64.rp m

Red Hat tcpdump-3.6.2-11.7.1.0.src.rpm
Source RPM.
ftp://updates.redhat.com/7.1/en/os/SRPMS/tcpdump-3.6.2-11.7.1.0.src.rp m

Red Hat tcpdump-3.6.2-11.7.2.0.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/tcpdump-3.6.2-11.7.2.0.i386.rp m

Red Hat tcpdump-3.6.2-11.7.2.0.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/tcpdump-3.6.2-11.7.2.0.ia64.rp m

Red Hat tcpdump-3.6.2-11.7.2.0.src.rpm
Source RPM.
ftp://updates.redhat.com/7.2/en/os/SRPMS/tcpdump-3.6.2-11.7.2.0.src.rp m

Trustix arpwatch-2.1a11-1tr.i586.rpm
Trustix Secure Linux 1.1.
ftp://ftp.trustix.net/pub/Trustix/updates/1.1/RPMS/arpwatch-2.1a11-1tr .i586.rpm

Trustix arpwatch-2.1a11-1tr.i586.rpm
Trustix Secure Linux 1.2.
ftp://ftp.trustix.net/pub/Trustix/updates/1.2/RPMS/arpwatch-2.1a11-1tr .i586.rpm

Trustix arpwatch-2.1a11-1tr.src.rpm
Trustix Secure Linux 1.1.
ftp://ftp.trustix.net/pub/Trustix/updates/1.1/SRPMS/arpwatch-2.1a11-1t r.src.rpm

Trustix arpwatch-2.1a11-1tr.src.rpm
Trustix Secure Linux 1.2.
ftp://ftp.trustix.net/pub/Trustix/updates/1.2/SRPMS/arpwatch-2.1a11-1t r.src.rpm

Trustix libpcap-0.6.2-1tr.i586.rpm
Trustix Secure Linux 1.1.
ftp://ftp.trustix.net/pub/Trustix/updates/1.1/RPMS/libpcap-0.6.2-1tr.i 586.rpm

Trustix libpcap-0.6.2-1tr.i586.rpm
Trustix Secure Linux 1.2.
ftp://ftp.trustix.net/pub/Trustix/updates/1.2/RPMS/libpcap-0.6.2-1tr.i 586.rpm

Trustix libpcap-0.6.2-1tr.src.rpm
Trustix Secure Linux 1.1.
ftp://ftp.trustix.net/pub/Trustix/updates/1.1/SRPMS/libpcap-0.6.2-1tr. src.rpm

Trustix libpcap-0.6.2-1tr.src.rpm
Trustix Secure Linux 1.2.
ftp://ftp.trustix.net/pub/Trustix/updates/1.2/SRPMS/libpcap-0.6.2-1tr. src.rpm

Trustix tcpdump-3.6.2-3tr.i586.rpm
Trustix Secure Linux 1.1.
ftp://ftp.trustix.net/pub/Trustix/updates/1.1/RPMS/tcpdump-3.6.2-3tr.i 586.rpm

Trustix tcpdump-3.6.2-3tr.i586.rpm
Trustix Secure Linux 1.2.
ftp://ftp.trustix.net/pub/Trustix/updates/1.2/RPMS/tcpdump-3.6.2-3tr.i 586.rpm

Trustix tcpdump-3.6.2-3tr.i586.rpm
Trustix Secure Linux 1.5.
ftp://ftp.trustix.net/pub/Trustix/updates/1.5/RPMS/tcpdump-3.6.2-3tr.i 586.rpm

Trustix tcpdump-3.6.2-3tr.src.rpm
Trustix Secure Linux 1.1.
ftp://ftp.trustix.net/pub/Trustix/updates/1.1/SRPMS/tcpdump-3.6.2-3tr. src.rpm

Trustix tcpdump-3.6.2-3tr.src.rpm
Trustix Secure Linux 1.2.
ftp://ftp.trustix.net/pub/Trustix/updates/1.2/SRPMS/tcpdump-3.6.2-3tr. src.rpm

Trustix tcpdump-3.6.2-3tr.src.rpm
Trustix Secure Linux 1.5.
ftp://ftp.trustix.net/pub/Trustix/updates/1.5/SRPMS/tcpdump-3.6.2-3tr. src.rpm

LBL tcpdump 3.7

FreeBSD tcpdump.patch
This patch applies to tcpdump for FreeBSD 4.4, 4.5 and 4.6 systems. To apply:Execute the following commands as root:# cd /usr/src# patch < /path/to/patch# cd /usr/src/usr.sbin/tcpdump# make depend && make && make install
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:29/tcpdump.patch