Tcpdump Protocol Four and Zero Header Length Vulnerability

Bugtraq ID:	313
Class:	Unknown
CVE:	CVE-1999-1024
Remote:	Yes
Local:	No
Published:	Jun 16 1999 12:00AM
Updated:	Jul 11 2009 12:16AM
Credit:	This vulnerability was published in the BUGTRAQ mailing lists by badi <[email protected]>.
Vulnerable:	LBL tcpdump 3.4 + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha + Redhat Linux 7.0 i386 + Redhat Linux 7.0 alpha + Redhat Linux 6.2 sparc + Redhat Linux 6.2 i386 + Redhat Linux 6.2 alpha
Not Vulnerable:

Tcpdump Protocol Four and Zero Header Length Vulnerability

A vulnerability in tcpdump causes it to enter an infinite loop within the procedure ip_print() from the file print_ip.c when it receives a packet with IP protocol number four and a zero header length and it tries to print it. This may allow remote malicious users to evade network monitoring.

Tcpdump Protocol Four and Zero Header Length Vulnerability

x

• /data/vulnerabilities/exploits/tcpdumpter.c

Tcpdump Protocol Four and Zero Header Length Vulnerability

Solution:
Apply this patch:

diff -r -p print-ip.orig.c print-ip.c
*** print-ip.orig.c Thu Jun 17 11:24:17 1999
--- print-ip.c Thu Jun 17 14:07:50 1999
*************** ip_print(register const u_char *bp, regi
*** 374,379 ****
--- 374,384 ----
(void)printf("truncated-ip %d", length);
return;
}
+
+ if (ip->ip_hl == 0) {
+ (void)printf("bad ip packet - header length = 0\n");
+ return;
+ }
hlen = ip->ip_hl * 4;

len = ntohs(ip->ip_len);

Tcpdump Protocol Four and Zero Header Length Vulnerability

References: