TCPDump AFS Signed Integer Buffer Overflow Vulnerability
BID:3065
Info
TCPDump AFS Signed Integer Buffer Overflow Vulnerability
| Bugtraq ID: | 3065 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2001-1279 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 17 2001 12:00AM |
| Updated: | Jul 11 2009 06:56AM |
| Credit: | This vulnerability was originally discovered by Nick Cleaton <[email protected]>, and announced in a FreeBSD Security Advisory on July 17, 2001. |
| Vulnerable: |
LBL tcpdump 3.6.2 |
| Not Vulnerable: | |
Discussion
TCPDump AFS Signed Integer Buffer Overflow Vulnerability
tcpdump is a freely available software package designed for analyzing network traffic in real-time.
A problem with tcpdump makes it possible for a remote user to execute arbitrary code. Due to a problem in the handling of input, AFS packet headers are handled as a signed integer. They're later passed through functions as unsigned integers, making it possible to overflow a buffer within the tcpdump program. This could result in a stack-based overflow, the overwriting of stack variables, and execution of arbitrary code. Since tcpdump is run by root or with SUID privileges, this could lead to the execution of code as root.
tcpdump is a freely available software package designed for analyzing network traffic in real-time.
A problem with tcpdump makes it possible for a remote user to execute arbitrary code. Due to a problem in the handling of input, AFS packet headers are handled as a signed integer. They're later passed through functions as unsigned integers, making it possible to overflow a buffer within the tcpdump program. This could result in a stack-based overflow, the overwriting of stack variables, and execution of arbitrary code. Since tcpdump is run by root or with SUID privileges, this could lead to the execution of code as root.
References
TCPDump AFS Signed Integer Buffer Overflow Vulnerability
References:
References: