RLSA-2020:4760 — Moderate: tcpdump security, bug fix, and enhancement update

Summary

The tcpdump packages contain the tcpdump utility for monitoring network traffic. The tcpdump utility can capture and display the packet headers on a particular network interface or on all interfaces.

The following packages have been upgraded to a later upstream version: tcpdump (4.9.3). (BZ#1804063)

Security Fix(es):

* tcpdump: SMB data printing mishandled (CVE-2018-10103)

* tcpdump: SMB data printing mishandled (CVE-2018-10105)

* tcpdump: Out of bounds read/write in get_next_file() in tcpdump.c (CVE-2018-14879)

* tcpdump: Buffer over-read in ldp_tlv_print() function in print-ldp.c (CVE-2018-14461)

* tcpdump: Buffer over-read in icmp_print() function in print-icmp.c (CVE-2018-14462)

* tcpdump: Buffer over-read in vrrp_print() function in print-vrrp.c (CVE-2018-14463)

* tcpdump: Buffer over-read in lmp_print_data_link_subobjs() function in print-lmp.c (CVE-2018-14464)

* tcpdump: Buffer over-read in rsvp_obj_print() function in print-rsvp.c (CVE-2018-14465)

* tcpdump: Buffer over-read in print-icmp6.c (CVE-2018-14466)

* tcpdump: Buffer over-read in bgp_capabilities_print() in print-bgp.c (CVE-2018-14467)

* tcpdump: Buffer over-read in mfr_print() function in print-fr.c (CVE-2018-14468)

* tcpdump: Buffer over-read in ikev1_n_print() function in print-isakmp.c (CVE-2018-14469)

* tcpdump: Buffer over-read in babel_print_v2() in print-babel.c (CVE-2018-14470)

* tcpdump: Buffer over-read in ospf6_print_lshdr() function in print-ospf6.c (CVE-2018-14880)

* tcpdump: Buffer over-read in bgp_capabilities_print() function in print-bgp.c (CVE-2018-14881)

* tcpdump: Buffer over-read in function rpl_dio_printopt in print-icmp6.c (CVE-2018-14882)

* tcpdump: Buffer over-read in print-802_11.c (CVE-2018-16227)

* tcpdump: Access to uninitialized buffer in print_prefix() function in print-hncp.c (CVE-2018-16228)

* tcpdump: Buffer over-read in dccp_print_option() function in print-dccp.c (CVE-2018-16229)

* tcpdump: Buffer over-read in bgp_attr_print() function in print-bgp.c (CVE-2018-16230)

* tcpdump: Resource exhaustion in bgp_attr_print() function in print-bgp.c (CVE-2018-16300)

* tcpdump: Buffer over-read in print_trans() function in print-smb.c (CVE-2018-16451)

* tcpdump: Resource exhaustion in smb_fdata() funtion in smbutil.c (CVE-2018-16452)

* tcpdump: Buffer overflow in lmp_print_data_link_subobjs() in print-lmp.c (CVE-2019-15166)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.

Fixed packages 1

Release	Package	Fixed in
Rocky Linux · 8	tcpdump	4:4.9.3-1.el8

Vulnerabilities 24

Critical 9.8

CVE-2018-14881 Public exploit

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_REST…

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Critical 9.8

CVE-2018-14882

The ICMPv6 parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp6.c.

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Critical 9.8

CVE-2018-16228

The HNCP parser in tcpdump before 4.9.3 has a buffer over-read in print-hncp.c:print_prefix().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Critical 9.8

CVE-2018-16230

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI).

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Critical 9.8

CVE-2018-16451

The SMB parser in tcpdump before 4.9.3 has buffer over-reads in print-smb.c:print_trans() for \MAILSLOT\BROWSE and \PIP…

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
High 7.5

CVE-2018-14461

The LDP parser in tcpdump before 4.9.3 has a buffer over-read in print-ldp.c:ldp_tlv_print().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
High 7.5

CVE-2018-14462

The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
High 7.5

CVE-2018-14465

The RSVP parser in tcpdump before 4.9.3 has a buffer over-read in print-rsvp.c:rsvp_obj_print().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
High 7.5

CVE-2018-14467

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_MP).

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
High 7.5

CVE-2018-14468

The FRF.16 parser in tcpdump before 4.9.3 has a buffer over-read in print-fr.c:mfr_print().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
High 7.5

CVE-2018-14470

The Babel parser in tcpdump before 4.9.3 has a buffer over-read in print-babel.c:babel_print_v2().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
High 7.5

CVE-2018-16300

The BGP parser in tcpdump before 4.9.3 allows stack consumption in print-bgp.c:bgp_attr_print() because of unlimited re…

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
High 7.5

CVE-2018-16452

The SMB parser in tcpdump before 4.9.3 has stack exhaustion in smbutil.c:smb_fdata() via recursion.

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
High 7.0

CVE-2018-14879 Public exploit

The command-line argument parser in tcpdump before 4.9.3 has a buffer overflow in tcpdump.c:get_next_file().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Low 1.6

CVE-2019-15166 Public exploit

lmp_print in tcpdump lacks certain boundary checks

lmp_print_data_link_subobjs() in print-lmp.c in tcpdump before 4.9.3 lacks certain bounds checks.

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Unscored —

CVE-2018-10103

tcpdump before 4.9.3 mishandles the printing of SMB data (issue 1 of 2).

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Unscored —

CVE-2018-10105

tcpdump before 4.9.3 mishandles the printing of SMB data (issue 2 of 2).

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Unscored —

CVE-2018-14463

The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 2, a diffe…

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Unscored —

CVE-2018-14464

The LMP parser in tcpdump before 4.9.3 has a buffer over-read in print-lmp.c:lmp_print_data_link_subobjs().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Unscored —

CVE-2018-14466

The Rx parser in tcpdump before 4.9.3 has a buffer over-read in print-rx.c:rx_cache_find() and rx_cache_insert().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Unscored —

CVE-2018-14469 Public exploit

The IKEv1 parser in tcpdump before 4.9.3 has a buffer over-read in print-isakmp.c:ikev1_n_print().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Unscored —

CVE-2018-14880 Public exploit

The OSPFv3 parser in tcpdump before 4.9.3 has a buffer over-read in print-ospf6.c:ospf6_print_lshdr().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Unscored —

CVE-2018-16227

The IEEE 802.11 parser in tcpdump before 4.9.3 has a buffer over-read in print-802_11.c for the Mesh Flags subfield.

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Unscored —

CVE-2018-16229

The DCCP parser in tcpdump before 4.9.3 has a buffer over-read in print-dccp.c:dccp_print_option().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019

References

report
https://bugzilla.redhat.com/show_bug.cgi?id=1760430
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760445
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760447
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760449
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760453
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760455
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760457
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760458
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760461
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760463
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760464
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760468
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760504
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760505
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760506
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760507
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760509
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760512
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760513
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760514
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760516
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760517
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760518
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760520
report
https://bugzilla.redhat.com/show_bug.cgi?id=1804063

Moderate: tcpdump security, bug fix, and enhancement update

Summary

Fixed packages 1

Vulnerabilities 24

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_REST…

The ICMPv6 parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp6.c.

The HNCP parser in tcpdump before 4.9.3 has a buffer over-read in print-hncp.c:print_prefix().

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI).

The SMB parser in tcpdump before 4.9.3 has buffer over-reads in print-smb.c:print_trans() for \MAILSLOT\BROWSE and \PIP…

The LDP parser in tcpdump before 4.9.3 has a buffer over-read in print-ldp.c:ldp_tlv_print().

The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print().

The RSVP parser in tcpdump before 4.9.3 has a buffer over-read in print-rsvp.c:rsvp_obj_print().

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_MP).

The FRF.16 parser in tcpdump before 4.9.3 has a buffer over-read in print-fr.c:mfr_print().

The Babel parser in tcpdump before 4.9.3 has a buffer over-read in print-babel.c:babel_print_v2().

The BGP parser in tcpdump before 4.9.3 allows stack consumption in print-bgp.c:bgp_attr_print() because of unlimited re…

The SMB parser in tcpdump before 4.9.3 has stack exhaustion in smbutil.c:smb_fdata() via recursion.

The command-line argument parser in tcpdump before 4.9.3 has a buffer overflow in tcpdump.c:get_next_file().

lmp_print in tcpdump lacks certain boundary checks

tcpdump before 4.9.3 mishandles the printing of SMB data (issue 1 of 2).

tcpdump before 4.9.3 mishandles the printing of SMB data (issue 2 of 2).

The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 2, a diffe…

The LMP parser in tcpdump before 4.9.3 has a buffer over-read in print-lmp.c:lmp_print_data_link_subobjs().

The Rx parser in tcpdump before 4.9.3 has a buffer over-read in print-rx.c:rx_cache_find() and rx_cache_insert().

The IKEv1 parser in tcpdump before 4.9.3 has a buffer over-read in print-isakmp.c:ikev1_n_print().

The OSPFv3 parser in tcpdump before 4.9.3 has a buffer over-read in print-ospf6.c:ospf6_print_lshdr().

The IEEE 802.11 parser in tcpdump before 4.9.3 has a buffer over-read in print-802_11.c for the Mesh Flags subfield.

The DCCP parser in tcpdump before 4.9.3 has a buffer over-read in print-dccp.c:dccp_print_option().

References