CVE-2001-1279
CVSS7.5
发布时间 :2001-07-17 00:00:00
修订时间 :2008-09-10 15:10:10
NMCOS    

[原文]Buffer overflow in print-rx.c of tcpdump 3.x (probably 3.6x) allows remote attackers to cause a denial of service and possibly execute arbitrary code via AFS RPC packets with invalid lengths that trigger an integer signedness error, a different vulnerability than CVE-2000-1026.


[CNNVD]Tcpdump AFS 有符号整数缓冲区溢出漏洞(CNNVD-200107-105)

        CVE(CAN) ID: CAN-2001-1279
        
        
        
        tcpdump是一个免费的,用来实时分析网络通信的软件。
        
        
        
        FreeBSD 4.x的tcpdump版本存在一个可溢出的缓冲区。由于AFS RPC数据包解码的串长度
        
        处理错误,远程用户可以使缓冲区溢出,造成本地tcpdump进程崩溃。
        
        问题主要是因为某个长度域开始是作为一个有符号的整数处理,后来在传递给其他函数时
        
        又将其作为无符号整数处理。这就可能导致一个缓冲区溢出发生。
        
        
        
        如果攻击者小心地构造发送数据,攻击者也可能以运行tcpdump用户的权限(往往是root
        
        权限)执行任意代码。
        
        

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

产品及版本信息(CPE)暂不可用

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1279
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-1279
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200107-105
(官方数据源) CNNVD

- 其它链接及资源

http://www.kb.cert.org/vuls/id/797201
(VENDOR_ADVISORY)  CERT-VN  VU#797201
http://www.redhat.com/support/errata/RHSA-2001-089.html
(VENDOR_ADVISORY)  REDHAT  RHSA-2001:089
http://www.securityfocus.com/bid/3065
(UNKNOWN)  BID  3065
http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-032.php
(UNKNOWN)  MANDRAKE  MDKSA-2002:032
http://www.iss.net/security_center/static/7006.php
(UNKNOWN)  XF  tcpdump-afs-rpc-bo(7006)
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000480
(UNKNOWN)  CONECTIVA  CLA-2002:480
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:48.tcpdump.asc
(UNKNOWN)  FREEBSD  FreeBSD-SA-01:48
ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-025.0.txt
(UNKNOWN)  CALDERA  CSSA-2002-025.0

- 漏洞信息

Tcpdump AFS 有符号整数缓冲区溢出漏洞
高危 边界条件错误
2001-07-17 00:00:00 2005-05-13 00:00:00
远程  
        CVE(CAN) ID: CAN-2001-1279
        
        
        
        tcpdump是一个免费的,用来实时分析网络通信的软件。
        
        
        
        FreeBSD 4.x的tcpdump版本存在一个可溢出的缓冲区。由于AFS RPC数据包解码的串长度
        
        处理错误,远程用户可以使缓冲区溢出,造成本地tcpdump进程崩溃。
        
        问题主要是因为某个长度域开始是作为一个有符号的整数处理,后来在传递给其他函数时
        
        又将其作为无符号整数处理。这就可能导致一个缓冲区溢出发生。
        
        
        
        如果攻击者小心地构造发送数据,攻击者也可能以运行tcpdump用户的权限(往往是root
        
        权限)执行任意代码。
        
        

- 公告与补丁

        
        
        临时解决办法
        
        
        
        不要在可能有来自不可信来源数据包的网络环境中使用受影响的tcpdump版本。
        
        
        
        厂商补丁:
        
        
        
        FreeBSD已经为此发布了一个安全公告(FreeBSD-SA-01:48.tcpdump)和相应的补丁。
        
        您可以在下列地址看到安全公告的详细内容:
        
        
        
        ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01_48.tcpdump.asc
        
        
        
        补丁下载:
        
        
        
        对于修正日期(2001-07-09)前发布的FreeBSD 4.x系统:
        
        
        
        从下列网站下载补丁:
        
        
        
        ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:48/tcpdump-4.x.patch
        
        
        
        # cd /usr/src/contrib/tcpdump
        
        # patch -p < /path/to/patch
        
        # cd /usr/src/usr.sbin/tcpdump
        
        # make depend && make all install
        
        
        

- 漏洞信息

9852
tcpdump print-rx.c AFS RPC Invalid Length Packet Overflow DoS
Denial of Service, Input Manipulation
Loss of Integrity, Loss of Availability

- 漏洞描述

Unknown or Incomplete

- 时间线

2001-07-17 Unknow
Unknow Unknow

- 解决方案

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

TCPDump AFS Signed Integer Buffer Overflow Vulnerability
Boundary Condition Error 3065
Yes No
2001-07-17 12:00:00 2009-07-11 06:56:00
This vulnerability was originally discovered by Nick Cleaton <nick@cleaton.net>, and announced in a FreeBSD Security Advisory on July 17, 2001.

- 受影响的程序版本

LBL tcpdump 3.6.2
+ Caldera OpenLinux Server 3.1.1
+ Caldera OpenLinux Server 3.1
+ Caldera OpenLinux Workstation 3.1.1
+ Caldera OpenLinux Workstation 3.1
+ Conectiva Linux 8.0
+ Conectiva Linux 7.0
+ Conectiva Linux 6.0
+ Conectiva Linux 5.1
+ Conectiva Linux 5.0
+ Debian Linux 3.0 sparc
+ Debian Linux 3.0 s/390
+ Debian Linux 3.0 ppc
+ Debian Linux 3.0 mipsel
+ Debian Linux 3.0 mips
+ Debian Linux 3.0 m68k
+ Debian Linux 3.0 ia-64
+ Debian Linux 3.0 ia-32
+ Debian Linux 3.0 hppa
+ Debian Linux 3.0 arm
+ Debian Linux 3.0 alpha
+ Debian Linux 3.0
+ FreeBSD FreeBSD 4.3
+ FreeBSD FreeBSD 4.2
+ FreeBSD FreeBSD 4.1.1
+ FreeBSD FreeBSD 4.1
+ FreeBSD FreeBSD 4.0
+ HP Secure OS software for Linux 1.0
+ MandrakeSoft Corporate Server 1.0.1
+ MandrakeSoft Single Network Firewall 7.2
+ Mandriva Linux Mandrake 8.2
+ Mandriva Linux Mandrake 8.1
+ Mandriva Linux Mandrake 8.0
+ Mandriva Linux Mandrake 7.2
+ Mandriva Linux Mandrake 7.1
+ RedHat Linux 7.2 ia64
+ RedHat Linux 7.2 i386
+ RedHat Linux 7.1 ia64
+ RedHat Linux 7.1 i386
+ RedHat Linux 7.1 alpha
+ RedHat Linux 7.0 i386
+ RedHat Linux 7.0 alpha
+ RedHat Linux 6.2 sparc
+ RedHat Linux 6.2 i386
+ RedHat Linux 6.2 alpha
+ S.u.S.E. Linux 8.0
+ Trustix Secure Linux 1.5
+ Trustix Secure Linux 1.2
+ Trustix Secure Linux 1.1

- 漏洞讨论

tcpdump is a freely available software package designed for analyzing network traffic in real-time.

A problem with tcpdump makes it possible for a remote user to execute arbitrary code. Due to a problem in the handling of input, AFS packet headers are handled as a signed integer. They're later passed through functions as unsigned integers, making it possible to overflow a buffer within the tcpdump program. This could result in a stack-based overflow, the overwriting of stack variables, and execution of arbitrary code. Since tcpdump is run by root or with SUID privileges, this could lead to the execution of code as root.

- 漏洞利用

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com &lt;mailto:vuldb@securityfocus.com&gt;.

- 解决方案

Fixes available:


LBL tcpdump 3.6.2

- 相关参考

     

     

    关于SCAP中文社区

    SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

    版权声明

    CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站