OpenPKG CVS Repository http://cvs.openpkg.org/ ____________________________________________________________________________
Server: cvs.openpkg.org Name: Michael Schloh Root: /e/openpkg/cvs Email: [EMAIL PROTECTED] Module: openpkg-web Date: 07-Apr-2004 15:02:19 Branch: HEAD Handle: 2004040714021900 Added files: openpkg-web/security OpenPKG-SA-2004.010-tcpdump.txt Log: first draft OpenPKG-SA-2004.010-tcpdump (CAN-2004-0183 and CAN-2004-0184), to accompany update packages tcpdump-3.8.1-2.0.1.src.rpm and tcpdump-3.7.2-1.3.2.src.rpm Summary: Revision Changes Path 1.1 +76 -0 openpkg-web/security/OpenPKG-SA-2004.010-tcpdump.txt ____________________________________________________________________________ patch -p0 <<'@@ .' Index: openpkg-web/security/OpenPKG-SA-2004.010-tcpdump.txt ============================================================================ $ cvs diff -u -r0 -r1.1 OpenPKG-SA-2004.010-tcpdump.txt --- /dev/null 2004-04-07 15:02:19.000000000 +0200 +++ OpenPKG-SA-2004.010-tcpdump.txt 2004-04-07 15:02:19.000000000 +0200 @@ -0,0 +1,76 @@ +________________________________________________________________________ + +OpenPKG Security Advisory The OpenPKG Project +http://www.openpkg.org/security.html http://www.openpkg.org [EMAIL PROTECTED] [EMAIL PROTECTED] +OpenPKG-SA-2004.010 07-Apr-2004 +________________________________________________________________________ + +Package: tcpdump +Vulnerability: denial of service +OpenPKG Specific: no + +Affected Releases: Affected Packages: Corrected Packages: +OpenPKG CURRENT <= tcpdump-3.8.1-20040207 >= tcpdump-3.8.2-20040330 +OpenPKG 2.0 <= tcpdump-3.8.1-2.0.0 >= tcpdump-3.8.1-2.0.1 +OpenPKG 1.3 <= tcpdump-3.7.2-1.3.1 >= tcpdump-3.7.2-1.3.2 + +Dependent Packages: none + +Description: + According to a security advisory published by Rapid7 [0], two + vulnerabilities exists in the ISAKMP packet display functions of + tcpdump [1]. The Common Vulnerabilities and Exposures (CVE) project + has reviewed both problems. CAN-2004-0183 [2] identifies an overflow + when displaying ISAKMP delete payloads with large number of SPIs, + while CAN-2004-0184 [3] identifies an integer underflow when + displaying ISAKMP identification payload. These vulnerabilities + appear only when verbose packet display is enabled by running tcpdump + with the -v option. + + Please check whether you are affected by running "<prefix>/bin/rpm + -q tcpdump". If you have the "tcpdump" package installed and its + version is affected (see above), we recommend that you immediately + upgrade it (see Solution). [4][5] + +Solution: + Select the updated source RPM appropriate for your OpenPKG release + [6][7], fetch it from the OpenPKG FTP service [8][9] or a mirror + location, verify its integrity [10], build a corresponding binary RPM + from it [4] and update your OpenPKG installation by applying the + binary RPM [5]. For the most current release OpenPKG 2.0, perform the + following operations to permanently fix the security problem (for + other releases adjust accordingly). + + $ ftp ftp.openpkg.org + ftp> bin + ftp> cd release/2.0/UPD + ftp> get tcpdump-3.8.1-2.0.1.src.rpm + ftp> bye + $ <prefix>/bin/rpm -v --checksig tcpdump-3.8.1-2.0.1.src.rpm + $ <prefix>/bin/rpm --rebuild tcpdump-3.8.1-2.0.1.src.rpm + $ su - + # <prefix>/bin/rpm -Fvh <prefix>/RPM/PKG/tcpdump-3.8.1-2.0.1.*.rpm +________________________________________________________________________ + +References: + [0] http://www.rapid7.com/advisories/R7-0017.html + [1] http://www.tcpdump.org/ + [2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0183 + [3] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0184 + [4] http://www.openpkg.org/tutorial.html#regular-source + [5] http://www.openpkg.org/tutorial.html#regular-binary + [6] ftp://ftp.openpkg.org/release/1.3/UPD/tcpdump-3.7.1-1.3.2.src.rpm + [7] ftp://ftp.openpkg.org/release/2.0/UPD/tcpdump-3.8.1-2.0.1.src.rpm + [8] ftp://ftp.openpkg.org/release/1.3/UPD/ + [9] ftp://ftp.openpkg.org/release/2.0/UPD/ + [10] http://www.openpkg.org/security.html#signature +________________________________________________________________________ + +For security reasons, this advisory was digitally signed with the +OpenPGP public key "OpenPKG <[EMAIL PROTECTED]>" (ID 63C4CB9F) of the +OpenPKG project which you can retrieve from http://pgp.openpkg.org and +hkp://pgp.openpkg.org. Follow the instructions on http://pgp.openpkg.org/ +for details on how to verify the integrity of this advisory. +________________________________________________________________________ + @@ . ______________________________________________________________________ The OpenPKG Project www.openpkg.org CVS Repository Commit List [EMAIL PROTECTED]