BID:6974

TCPDump Malformed ISAKMP Packet Denial Of Service Vulnerability

Info

TCPDump Malformed ISAKMP Packet Denial Of Service Vulnerability

Bugtraq ID:	6974
Class:	Design Error
CVE:	CVE-2003-0108
Remote:	Yes
Local:	No
Published:	Feb 27 2003 12:00AM
Updated:	Jul 11 2009 08:06PM
Credit:	Discovery of this vulnerability is credited to Andrew Griffiths <[email protected]>
Vulnerable:	SuSE Linux 8.1 SuSE Linux 8.0 S.u.S.E. Linux Personal 9.0 x86_64 S.u.S.E. Linux Personal 9.0 S.u.S.E. Linux Personal 8.2 LBL tcpdump 3.7.1 + FreeBSD FreeBSD 4.7 -RELEASE + FreeBSD FreeBSD 4.7 + Gentoo Linux 1.4 _rc2 + Gentoo Linux 1.4 _rc1 + SuSE Linux 8.1 LBL tcpdump 3.7 + FreeBSD FreeBSD 4.6 -RELEASE + FreeBSD FreeBSD 4.6 + FreeBSD FreeBSD 4.5 -STABLE + FreeBSD FreeBSD 4.5 -RELEASE + FreeBSD FreeBSD 4.5 + FreeBSD FreeBSD 4.4 -STABLE + FreeBSD FreeBSD 4.4 -RELENG + FreeBSD FreeBSD 4.4 + FreeBSD FreeBSD 4.3 -STABLE + FreeBSD FreeBSD 4.3 -RELENG + FreeBSD FreeBSD 4.3 -RELEASE + FreeBSD FreeBSD 4.3 + FreeBSD FreeBSD 4.2 -STABLE + FreeBSD FreeBSD 4.2 -RELEASE + FreeBSD FreeBSD 4.2 LBL tcpdump 3.6.2 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1.1 + Caldera OpenLinux Workstation 3.1 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 + FreeBSD FreeBSD 4.3 + FreeBSD FreeBSD 4.2 + FreeBSD FreeBSD 4.1.1 + FreeBSD FreeBSD 4.1 + FreeBSD FreeBSD 4.0 + HP Secure OS software for Linux 1.0 + MandrakeSoft Corporate Server 1.0.1 + MandrakeSoft Single Network Firewall 7.2 + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.0 + Mandriva Linux Mandrake 7.2 + Mandriva Linux Mandrake 7.1 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha + Redhat Linux 7.0 i386 + Redhat Linux 7.0 alpha + Redhat Linux 6.2 sparc + Redhat Linux 6.2 i386 + Redhat Linux 6.2 alpha + SuSE Linux 8.0 + Trustix Secure Linux 1.5 + Trustix Secure Linux 1.2 + Trustix Secure Linux 1.1 LBL tcpdump 3.5.2

Not Vulnerable:	LBL tcpdump 3.7.2 + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 + MandrakeSoft Multi Network Firewall 2.0 + Mandriva Linux Mandrake 9.2 amd64 + Mandriva Linux Mandrake 9.2 + Mandriva Linux Mandrake 9.1 ppc + Mandriva Linux Mandrake 9.1 + Turbolinux Turbolinux Advanced Server 6.0 + Turbolinux Turbolinux Desktop 10.0 + Turbolinux Turbolinux Server 8.0 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Server 6.5 + Turbolinux Turbolinux Server 6.1 + Turbolinux Turbolinux Workstation 8.0 + Turbolinux Turbolinux Workstation 7.0 + Turbolinux Turbolinux Workstation 6.1 + Turbolinux Turbolinux Workstation 6.0 LBL tcpdump 3.4 a6 + Debian Linux 2.2 sparc + Debian Linux 2.2 powerpc + Debian Linux 2.2 IA-32 + Debian Linux 2.2 arm + Debian Linux 2.2 alpha + Debian Linux 2.2 68k + Debian Linux 2.2 + S.u.S.E. Firewall Adminhost VPN + S.u.S.E. Linux Admin-CD for Firewall + S.u.S.E. Linux Connectivity Server + S.u.S.E. Linux Database Server 0 + S.u.S.E. Linux Enterprise Server for S/390 + S.u.S.E. Linux Live-CD for Firewall + S.u.S.E. SuSE eMail Server III + SuSE Linux 7.2 + SuSE Linux 7.1 + SuSE Linux 7.0 + SuSE Linux 6.4 + SuSE SUSE Linux Enterprise Server 7

Discussion

TCPDump Malformed ISAKMP Packet Denial Of Service Vulnerability

It has been reported that tcpdump is vulnerable to a denial of service when some packet types are received. By sending a maliciously formatted packet to a system using a vulnerable version of tcpdump, it is possible for a remote user to cause tcpdump to ignore network traffic from the time the packet is received until the application is terminated and restarted.

Exploit / POC

TCPDump Malformed ISAKMP Packet Denial Of Service Vulnerability

The following proof of concept exploit was supplied:

/data/vulnerabilities/exploits/ST-tcphump.c

Solution / Fix

TCPDump Malformed ISAKMP Packet Denial Of Service Vulnerability

Solution:
SuSE has released an advisory (SuSE-SA:2004:002), which contains fixes to address this issue. Further information about obtaining and applying fixes can be found in the advisory.

Conectiva have released an advisory (CLA-2003:629). Information about obtaining and applying fixes are available in the referenced advisory.

OpenPKG have released an advisory (OpenPKG-SA-2003.014). Information about obtaining and applying fixes are available in the referenced advisory.

MandrakeSoft has released an advisory. Information about obtaining and applying fixes are available in the referenced advisory.

Gentoo Linux has released an advisory. Users who have installed net-analyzer/tcpdump are advised to upgrade to tcpdump-3.7.2 by issuing the following commands:

emerge sync
emerge -u tcpdump
emerge clean

SuSE has released an advisory (SuSE-SA:2003:0015) which contains fixes. Further information about obtaining and applying fixes can be found in the advisory.

Red Hat has released a security advisory (RHSA-2003:032-01) that contains fixes addressing this and other tcpdump issues. Users are advised to upgrade as soon as possible.

OpenPKG has released an advisory OpenPKG-SA-2004.002 to address this and other issues. Please see the referenced advisory for more information.

The following fixes are available:

LBL tcpdump 3.5.2