full-disclosure - Security Update: [CSSA-2002-050.0] Linux: tcpdump denial-of-service in print-bgp.c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20021119155531.X18657@caldera.com>
From: security at caldera.com (security@...dera.com)
Subject: Security Update: [CSSA-2002-050.0] Linux: tcpdump denial-of-service in print-bgp.c

To: bugtraq@...urityfocus.com announce@...ts.caldera.com security-alerts@...uxsecurity.com full-disclosure@...ts.netsys.com

______________________________________________________________________________

			SCO Security Advisory

Subject:		Linux: tcpdump denial-of-service in print-bgp.c 
Advisory number: 	CSSA-2002-050.0
Issue date: 		2002 November 19
Cross reference:
______________________________________________________________________________


1. Problem Description

	There is a miscalculation in the use of the sizeof operator in
	tcpdump, allowing, at the least, a denial-of-service attack.


2. Vulnerable Supported Versions

	System				Package
	----------------------------------------------------------------------

	OpenLinux 3.1.1 Server		prior to tcpdump-3.6.2-4.i386.rpm

	OpenLinux 3.1.1 Workstation	prior to tcpdump-3.6.2-4.i386.rpm

	OpenLinux 3.1 Server		prior to tcpdump-3.6.2-4.i386.rpm

	OpenLinux 3.1 Workstation	prior to tcpdump-3.6.2-4.i386.rpm


3. Solution

	The proper solution is to install the latest packages. Many
	customers find it easier to use the Caldera System Updater, called
	cupdate (or kcupdate under the KDE environment), to update these
	packages rather than downloading and installing them by hand.


4. OpenLinux 3.1.1 Server

	4.1 Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-050.0/RPMS

	4.2 Packages

	88099679d803eb7f1583f99ccaa68fed	tcpdump-3.6.2-4.i386.rpm

	4.3 Installation

	rpm -Fvh tcpdump-3.6.2-4.i386.rpm

	4.4 Source Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-050.0/SRPMS

	4.5 Source Packages

	098cc3870c3f665a0d8ca1ab33bd3aca	tcpdump-3.6.2-4.src.rpm


5. OpenLinux 3.1.1 Workstation

	5.1 Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-050.0/RPMS

	5.2 Packages

	45db66a34637547e551b5c6617a96146	tcpdump-3.6.2-4.i386.rpm

	5.3 Installation

	rpm -Fvh tcpdump-3.6.2-4.i386.rpm

	5.4 Source Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-050.0/SRPMS

	5.5 Source Packages

	debcc7c371ef1857da6cf5beb2c9fb99	tcpdump-3.6.2-4.src.rpm


6. OpenLinux 3.1 Server

	6.1 Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-050.0/RPMS

	6.2 Packages

	890d010599a09f88ab2264e3c737e8b8	tcpdump-3.6.2-4.i386.rpm

	6.3 Installation

	rpm -Fvh tcpdump-3.6.2-4.i386.rpm

	6.4 Source Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-050.0/SRPMS

	6.5 Source Packages

	57282f9d95d4ac217472b37e1e4424ca	tcpdump-3.6.2-4.src.rpm


7. OpenLinux 3.1 Workstation

	7.1 Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-050.0/RPMS

	7.2 Packages

	2e80f4e77cee7899bfbfc7c0552da424	tcpdump-3.6.2-4.i386.rpm

	7.3 Installation

	rpm -Fvh tcpdump-3.6.2-4.i386.rpm

	7.4 Source Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-050.0/SRPMS

	7.5 Source Packages

	d16939d580b36f127b12693548f17655	tcpdump-3.6.2-4.src.rpm


8. References

	Specific references for this advisory:
		none

	SCO security resources:
		http://www.sco.com/support/security/index.html

	This security fix closes SCO incidents sr869390, fz526125,
	erg712131.


9. Disclaimer

	SCO is not responsible for the misuse of any of the information
	we provide on this website and/or through our security
	advisories. Our advisories are a service to our customers intended
	to promote secure installation and use of SCO products.

______________________________________________________________________________
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 237 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20021119/325f6637/attachment.bin