Title: tcpdump AFS ACL Packet Buffer Overflow Vulnerability
Severity: HIGH
Description:
tcpdump is a popular network monitoring tool used for watching network traffic written by the Lawrence Berkeley Laboratory. It must at least begin execution as root since it opens and reads from the link layer interface (through pcap). It is usually run directly by/as root.
tcpdump is vulnerable to a remotely exploitable buffer overflow in it's parsing of AFS ACL packets. This is likely the result of the AFS packet fields received over a network interface being copied into memory buffers of predefined length without checks for size. The excessive data could be used to overwrite stack variables if constructed correctly and allow the attacker (who would have sent the custom ACL packets) to gain remote access to the victim host.
Exploitation of this vulnerability would likely yield root access for the perpetrator.
Affected Products:
- Debian Linux 2.2.0
- Debian Linux 2.2.0 68k
- Debian Linux 2.2.0 IA-32
- Debian Linux 2.2.0 alpha
- Debian Linux 2.2.0 arm
- Debian Linux 2.2.0 powerpc
- Debian Linux 2.2.0 sparc
- FreeBSD FreeBSD 3.x
- FreeBSD FreeBSD 4.0.0
- FreeBSD FreeBSD 4.1.0
- FreeBSD FreeBSD 4.1.1
- LBL tcpdump 3.4.0
- LBL tcpdump 3.4.0a6
- LBL tcpdump 3.5.0
- LBL tcpdump 3.5.0 alpha
- RedHat Linux 6.2.0 alpha
- RedHat Linux 6.2.0 i386
- RedHat Linux 6.2.0 sparc
- RedHat Linux 7.0.0 alpha
- RedHat Linux 7.0.0 i386
- RedHat Linux 7.1.0 alpha
- RedHat Linux 7.1.0 i386
- RedHat Linux 7.1.0 ia64
- S.u.S.E. Firewall Adminhost VPN 0.0.0
- S.u.S.E. Linux 6.4.0
- S.u.S.E. Linux 7.0.0
- S.u.S.E. Linux 7.1.0
- S.u.S.E. Linux 7.2.0
- S.u.S.E. Linux 7.3.0
- S.u.S.E. Linux 8.0.0
- S.u.S.E. Linux Admin-CD for Firewall 0.0.0
- S.u.S.E. Linux Connectivity Server
- S.u.S.E. Linux Database Server
- S.u.S.E. Linux Enterprise Server 7
- S.u.S.E. Linux Enterprise Server for S/390
- S.u.S.E. Linux Live-CD for Firewall 0.0.0
- S.u.S.E. SuSE eMail Server III
References:
- Lawrence Berkeley Laboratory: LBNL's Network Research Group
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
