PT-2003-1076 · Arpwatch+2 · Arpwatch+2
Published
2003-03-31
·
Updated
2017-10-10
·
CVE-2003-0145
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
tcpdump versions prior to 3.7.2
libpcap version 0.6.2
tcpdump version 3.6.3
arpwatch version 2.1a11
Description
The issue is related to an inability to handle unknown RADIUS attributes properly, allowing remote attackers to cause a denial of service, specifically an infinite loop. Multiple vulnerabilities in the libpcap, tcpdump, and arpwatch packages may lead to disruptions in confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely.
Recommendations
For tcpdump versions prior to 3.7.2, update to version 3.7.2 or later to resolve the issue.
For libpcap version 0.6.2, consider restricting access to the package until a patch is available.
For tcpdump version 3.6.3, avoid using the package for critical operations until an update is applied.
For arpwatch version 2.1a11, temporarily disable the package to minimize the risk of exploitation.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Arpwatch
Libpcap
Tcpdump