ID

VAR-200505-1240

CVE

CVE-2005-1280

TITLE

OpenSSL may fail to properly parse invalid ASN.1 structures

DESCRIPTION

The rsvp_print function in tcpdump 3.9.1 and earlier allows remote attackers to cause a denial of service (infinite loop) via a crafted RSVP packet of length 4. A buffer overflow in certain Apple AirPort drivers may allow an attacker to execute arbitrary code with system privileges, or create a denial-of-service condition. Multiple RSA implementations fail to properly handle RSA signatures. This vulnerability may allow an attacker to forge RSA signatures. ------------ This vulnerability information is a summary of multiple vulnerabilities released at the same time. Please note that the contents of vulnerability information other than the title are included. ------------ tcpdump Is a management tool for capturing network traffic and supports multiple protocols. The issue occurs because of the way tcpdump decodes Resource ReSerVation Protocol (RSVP) packets. This issue affects tcpdump 3.9.x/CVS and earlier. This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig72CF56A4065A77499C855538 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable --------------------------------------------------------------------- Fedora Legacy Update Advisory Synopsis: Updated tcpdump packages fix security issues Advisory ID: FLSA:156139 Issue date: 2006-04-04 Product: Red Hat Linux, Fedora Core Keywords: Bugfix, Security CVE Names: CVE-2005-1267, CVE-2005-1278, CVE-2005-1279, CVE-2005-1280 --------------------------------------------------------------------- --------------------------------------------------------------------- 1. Topic: Updated tcpdump packages that fix several security issues are now available. 2. Relevant releases/architectures: Red Hat Linux 9 - i386 Fedora Core 1 - i386 Fedora Core 2 - i386 3. Problem description: Several denial of service bugs were found in the way tcpdump processes certain network packets. It is possible for an attacker to inject a carefully crafted packet onto the network, crashing a running tcpdump session. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-1267, CVE-2005-1278, CVE-2005-1279, and CVE-2005-1280 to these issues. Users of tcpdump are advised to upgrade to these erratum packages, which contain backported security patches and are not vulnerable to these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www.fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=3D156139 6. RPMs required: Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/tcpdump-3.7.2-7.9= =2E4.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/tcpdump-3.7.2-7.9.= 4.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/libpcap-0.7.2-7.9.= 4.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/arpwatch-2.1a11-7.= 9.4.legacy.i386.rpm Fedora Core 1: SRPM: http://download.fedoralegacy.org/fedora/1/updates/SRPMS/tcpdump-3.7.2-8.f= c1.3.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/1/updates/i386/tcpdump-3.7.2-8.fc= 1.3.legacy.i386.rpm http://download.fedoralegacy.org/fedora/1/updates/i386/libpcap-0.7.2-8.fc= 1.3.legacy.i386.rpm http://download.fedoralegacy.org/fedora/1/updates/i386/arpwatch-2.1a11-8.= fc1.3.legacy.i386.rpm Fedora Core 2: SRPM: http://download.fedoralegacy.org/fedora/2/updates/SRPMS/tcpdump-3.8.2-6.F= C2.3.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/2/updates/i386/tcpdump-3.8.2-6.FC= 2.3.legacy.i386.rpm http://download.fedoralegacy.org/fedora/2/updates/i386/libpcap-0.8.3-6.FC= 2.3.legacy.i386.rpm http://download.fedoralegacy.org/fedora/2/updates/i386/arpwatch-2.1a13-6.= FC2.3.legacy.i386.rpm 7. Verification: SHA1 sum Package Name --------------------------------------------------------------------- 0beccb4a6dd929174bc2d70d680a2e3c4a094391 redhat/9/updates/i386/tcpdump-3.7.2-7.9.4.legacy.i386.rpm 71e1ffc2c4dbf2a5c754630e198f17af94000e66 redhat/9/updates/i386/libpcap-0.7.2-7.9.4.legacy.i386.rpm 843a832974f531413a8e406491f6c91d09bda24d redhat/9/updates/i386/arpwatch-2.1a11-7.9.4.legacy.i386.rpm 192fa5bbebe8039f3c23b8aa26804d1c4b788412 redhat/9/updates/SRPMS/tcpdump-3.7.2-7.9.4.legacy.src.rpm 1a426b6225718dbd325fbe0c6d54f8904b710103 fedora/1/updates/i386/tcpdump-3.7.2-8.fc1.3.legacy.i386.rpm 45cffdb7d98c2eb03da004d89b776a7050ff5c40 fedora/1/updates/i386/libpcap-0.7.2-8.fc1.3.legacy.i386.rpm 75e263aa296969c873d0475cc1c0785c30ea24d6 fedora/1/updates/i386/arpwatch-2.1a11-8.fc1.3.legacy.i386.rpm 6e86c20a8af1fc607809c713d7ac00ab5e2f717c fedora/1/updates/SRPMS/tcpdump-3.7.2-8.fc1.3.legacy.src.rpm 32d0dcf31fbe12225954cc32dad45dbcb6c5f5e4 fedora/2/updates/i386/tcpdump-3.8.2-6.FC2.3.legacy.i386.rpm c84625e92600faa8566129c8229daa6c328dcee9 fedora/2/updates/i386/libpcap-0.8.3-6.FC2.3.legacy.i386.rpm dbdcbed104a6d3985a0735aab55031a3be0e1a74 fedora/2/updates/i386/arpwatch-2.1a13-6.FC2.3.legacy.i386.rpm bb98c4cd71507e4dec94da2c1c9f95ee9bbacde1 fedora/2/updates/SRPMS/tcpdump-3.8.2-6.FC2.3.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy.org/about/security.php You can verify each package with the following command: rpm --checksig -v <filename> If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum <filename> 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2005-1267 http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2005-1278 http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2005-1279 http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2005-1280 9. Contact: The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More project details at http://www.fedoralegacy.org --------------------------------------------------------------------- --------------enig72CF56A4065A77499C855538 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) iD8DBQFEMxLYLMAs/0C4zNoRAk8xAJ4utHt2OOExJbd3DH8xtLyfe4YcyACeLsad ZdMzjYDTapqXGKau0WRk570= =BXab -----END PGP SIGNATURE----- --------------enig72CF56A4065A77499C855538-- . ---------------------------------------------------------------------- To improve our services to our customers, we have made a number of additions to the Secunia Advisories and have started translating the advisories to German. The improvements will help our customers to get a better understanding of how we reached our conclusions, how it was rated, our thoughts on exploitation, attack vectors, and scenarios. This includes: * Reason for rating * Extended description * Extended solution * Exploit code or links to exploit code * Deep links Read the full description: http://corporate.secunia.com/products/48/?r=l Contact Secunia Sales for more information: http://corporate.secunia.com/how_to_buy/15/?r=l ---------------------------------------------------------------------- TITLE: Apple Airport Probe Response Kernel Memory Corruption Vulnerability SECUNIA ADVISORY ID: SA22679 VERIFY ADVISORY: http://secunia.com/advisories/22679/ CRITICAL: Moderately critical IMPACT: DoS, System access WHERE: >From remote OPERATING SYSTEM: Apple Macintosh OS X http://secunia.com/product/96/ DESCRIPTION: H.D. Moore has reported a vulnerability in the Apple Airport driver, which potentially can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to an error in the Airport driver provided with Orinoco-based Airport cards when handling probe response frames. This can be exploited to overwrite kernel memory and potentially execute arbitrary code when the driver is running in active scanning mode. The vulnerability is reported in the driver on a PowerBook running version 10.4.8. Other versions may also be affected. SOLUTION: Do not place the card into active scanning mode. PROVIDED AND/OR DISCOVERED BY: H D Moore ORIGINAL ADVISORY: http://projects.info-pull.com/mokb/MOKB-01-11-2006.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-analyzer/tcpdump < 3.8.3-r2 >= 3.8.3-r2 Description =========== TCPDump improperly handles and decodes ISIS, BGP, LDP (CAN-2005-1279) and RSVP (CAN-2005-1280) packets. TCPDump might loop endlessly after receiving malformed packets. Workaround ========== There is no known workaround at this time. Resolution ========== All TCPDump users should upgrade to the latest available version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/tcpdump-3.8.3-r2" References ========== [ 1 ] CAN-2005-1279 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2005-1279 [ 2 ] CAN-2005-1280 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2005-1280 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200505-06.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2005 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.0

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

other

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Vade 79 v9@fakehalo.deadpig.org

SOURCES

LAST UPDATE DATE

2025-09-28T22:36:38.503000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE