Red Hat Linux tcpdump Privilege Retention Weakness

Bugtraq ID:	7606
Class:	Configuration Error
CVE:	CVE-2003-0194
Remote:	Yes
Local:	No
Published:	May 15 2003 12:00AM
Updated:	Jul 11 2009 10:06PM
Credit:	Announced by Red Hat.
Vulnerable:	Sun Cobalt RaQ XTR Sun Cobalt RaQ 4 Redhat tcpdump-3.7.2-1.i386.rpm + Redhat Linux 9.0 i386 Redhat tcpdump-3.6.3-3.i386.rpm + Redhat Linux 8.0 Redhat tcpdump-3.6.3-17.i386.rpm + Redhat Linux 8.0 + Redhat Linux 7.3 + Redhat Linux 7.2 + Redhat Linux 7.1 + Sun Linux 5.0.5 Redhat tcpdump-3.6.2-9.ia64.rpm + Redhat Linux 7.2 ia64 Redhat tcpdump-3.6.2-9.i386.rpm + Redhat Linux 7.2 Redhat tcpdump-3.6.2-12.i386.rpm + Redhat Linux 7.3 Redhat tcpdump-3.4-39.i386.rpm + Redhat Linux 7.1 Redhat Linux 9.0 i386 Redhat Linux 8.0 i386 Redhat Linux 7.3 i386 Redhat Linux 7.2 ia64 Redhat Linux 7.2 i386 Redhat Linux 7.2 athlon Redhat Linux 7.2 alpha Redhat Linux 7.2 Redhat Linux 7.1 k i386 Redhat Linux 7.1 ia64 Redhat Linux 7.1 i386 Redhat Linux 7.1 alpha Redhat Linux 7.1
Not Vulnerable:

Red Hat Linux tcpdump Privilege Retention Weakness

By design, tcpdump on Red Hat Linux should lower its privileges from root to user pcap after it has begun reading from an interface. Due to a compilation error, this did not correctly occur unless manually specified at runtime with a command-line parameter. As a result tcpdump may run on systems with root privileges when administrators assume they've been dropped.

Red Hat Linux tcpdump Privilege Retention Weakness

There is no exploit code required.

Red Hat Linux tcpdump Privilege Retention Weakness

Solution:
Sun have released a security update to address this issue in the RAQ XTR. Please see references section for further details. A fix is linked below.

Sun has released updates for Sun Linux 5.0.5. Sun has also made a fix for Cobalt RaQ4 systems available.

Red Hat has released corrected packages. See the advisory located in the reference section for download URLs.


Redhat tcpdump-3.6.2-9.i386.rpm

• Red Hat tcpdump-3.6.3-17.7.2.3.i386.rpm
  ftp://updates.redhat.com/7.2/en/os/i386/tcpdump-3.6.3-17.7.2.3.i386.rp m

Redhat tcpdump-3.7.2-1.i386.rpm

• Red Hat tcpdump-3.7.2-1.9.1.i386.rpm
  ftp://updates.redhat.com/9/en/os/i386/tcpdump-3.7.2-1.9.1.i386.rpm

Redhat tcpdump-3.6.3-17.i386.rpm

• Sun tcpdump-3.6.3-17.7.2.3.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/tcpdump-3.6.3-17.7.2.3.i386.rpm


• Sun tcpdump-3.6.3-17.7.2.3.src.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/SRP MS/tcpdump-3.6.3-17.7.2.3.src.rpm

Sun Cobalt RaQ 4

• Sun RaQ4-All-Security-2.0.1-16504.pkg
  http://ftp.cobalt.sun.com/pub/packages/raq4/eng/RaQ4-All-Security-2.0. 1-16504.pkg

Redhat tcpdump-3.6.2-9.ia64.rpm

• Red Hat tcpdump-3.6.3-17.7.2.3.ia64.rpm
  ftp://updates.redhat.com/7.2/en/os/ia64/tcpdump-3.6.3-17.7.2.3.ia64.rp m

Redhat tcpdump-3.6.3-3.i386.rpm

• Red Hat tcpdump-3.6.3-17.8.0.3.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/tcpdump-3.6.3-17.8.0.3.i386.rp m

Redhat tcpdump-3.4-39.i386.rpm

• Red Hat tcpdump-3.6.3-17.7.1.3.i386.rpm
  ftp://updates.redhat.com/7.1/en/os/i386/tcpdump-3.6.3-17.7.1.3.i386.rp m

Redhat tcpdump-3.6.2-12.i386.rpm

• Red Hat tcpdump-3.6.3-17.7.3.3.i386.rpm
  ftp://updates.redhat.com/7.3/en/os/i386/tcpdump-3.6.3-17.7.3.3.i386.rp m

Sun Cobalt RaQ XTR

• Sun RaQXTR-All-Security-1.0.1-16504.pkg
  http://ftp.cobalt.sun.com/pub/packages/raqxtr/eng/RaQXTR-All-Security- 1.0.1-16504.pkg

Red Hat Linux tcpdump Privilege Retention Weakness

References:

• RaQ XTR Patch Page (Sun)
  
• Sun Linux Support - Sun Linux Patches (Sun)