APP: TCPDump ISAKMP Packet Parsing DoS

This signature detects attempts to exploit a known vulerability against TCPDump. TCPDump versions 3.6, 3.6.3, and 3.7.1 built against LIBPCAP versions .6 and .7 on both the Linux and FreeBSD platforms are vulnerable. Attackers can send a maliciously crafted packet to port UDP/500 that TCPDump attempts to parse as an ISAKMP packet, causing TCPDump to enter an infinite loop.

Extended Description

It has been reported that tcpdump is vulnerable to a denial of service when some packet types are received. By sending a maliciously formatted packet to a system using a vulnerable version of tcpdump, it is possible for a remote user to cause tcpdump to ignore network traffic from the time the packet is received until the application is terminated and restarted.

Affected Products

Suse linux_personal

Short Name
APP:ETHEREAL:TCPDUMP-ISAKMP-DOS
Severity
Minor
Recommended
False
Recommended Action
None
Category
APP
Keywords
CVE-2003-0108 DoS ISAKMP Packet Parsing TCPDump bid:6974
Release Date
04/22/2003
Supported Platforms

srx-branch-12.3

srx-19.3

srx-branch-19.3

vsrx3bsd-19.2

srx-branch-19.4

vsrx-19.4

mx-12.3

mx-19.4

vmx-19.4

mx-19.3

vsrx3bsd-19.4

srx-19.4

vsrx-12.3

vmx-19.3

vsrx-19.2

srx-12.3

Sigpack Version
3375
False Positive
Unknown
Vendors

Suse

Lbl

CVSS Score

5.0

Found a potential security threat?