PT-2003-1075 · Tcpdump · Tcpdump

Andrew Griffiths · Published 2003-03-07 · Updated 2016-10-18 · CVE-2003-0108

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions tcpdump versions 3.6 through 3.7.1

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, via a certain malformed ISAKMP packet to UDP port 500, which causes the software to enter an infinite loop. Multiple vulnerabilities in the tcpdump package may lead to disruption of confidentiality, integrity, and availability of protected information, and these vulnerabilities can be exploited remotely.

Recommendations For tcpdump versions 3.6 through 3.7.1, consider disabling the isakmp sub print function as a temporary workaround until a patch is available. Restrict access to UDP port 500 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

BDU:2015-07981

BDU:2015-08151

BDU:2015-08224

CVE-2003-0108

DSA-255

Affected Products

Tcpdump

References · 22

• 🔥 https://exploit-db.com/exploits/22294 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0108 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08151 · Security Note
• http://redhat.com/support/errata/RHSA-2003-032.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2003-0108 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-085.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07981 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2003-0108 · Security Note
• http://novell.com/linux/security/advisories/2003_015_tcpdump.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08224 · Security Note
• http://securityfocus.com/bid/6974 · Vendor Advisory
• http://debian.org/security/2003/dsa-255 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-214.html · Vendor Advisory
• http://iss.net/security_center/static/11434.php · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000629 · Vendor Advisory