Description
rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which might make it easier for attackers to enumerate valid usernames.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libpcap | 1.9.1-1 | — |
| Debian 13 | libpcap | 1.9.1-1 | — |
| Debian 12 | libpcap | 1.9.1-1 | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | libpcap | 1.9.1-r0 | — |
| Alpine v3.23 | libpcap | 1.9.1-r0 | — |
| Alpine v3.22 | libpcap | 1.9.1-r0 | — |
| Alpine v3.21 | libpcap | 1.9.1-r0 | — |
| Alpine v3.20 | libpcap | 1.9.1-r0 | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | libpcap | 1.9.1-r0 | — |
| Alpine v3.18 | libpcap | 1.9.1-r0 | — |
| Alpine v3.17 | libpcap | 1.9.1-r0 | — |
| Alpine v3.16 | libpcap | 1.9.1-r0 | — |
| Alpine v3.15 | libpcap | 1.9.1-r0 | — |
| Alpine v3.14 | libpcap | 1.9.1-r0 | — |
| Alpine v3.13 | libpcap | 1.9.1-r0 | — |
| Alpine v3.12 | libpcap | 1.9.1-r0 | — |
| Alpine v3.10 | libpcap | 1.1.1-r0 | — |
References
- https://www.tcpdump.org/public-cve-list.txt
- https://github.com/the-tcpdump-group/libpcap/blob/libpcap-1.9/CHANGES
- https://github.com/the-tcpdump-group/libpcap/commit/484d60cbf7ca4ec758c3cbb8a82d68b244a78d58
- FEDORA-2019-eaa681d33e vendor-advisory
- FEDORA-2019-4fe461079f vendor-advisory
- FEDORA-2019-b92ce3144a vendor-advisory
- https://support.apple.com/kb/HT210788
- https://support.apple.com/kb/HT210790
- https://support.apple.com/kb/HT210785
- https://support.apple.com/kb/HT210789
- 20191211 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra mailing-list
- 20191213 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra mailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html