FreeBSD Security Advisory FreeBSD-SA-01:48.tcpdump

FreeBSD Security Advisories security-advisories at
Tue Jul 17 10:49:25 PDT 2001


FreeBSD-SA-01:48                                           Security Advisory
                                                                FreeBSD, Inc.

Topic:          tcpdump contains remote buffer overflow

Category:       core
Module:         tcpdump
Announced:      2001-07-17
Credits:        Nick Cleaton <nick at>
Affects:        All releases of FreeBSD 4.x prior to 4.4,
                FreeBSD 4.3-STABLE prior to the correction date
		FreeBSD 3.x is unaffected.
Corrected:      2001-07-09
Vendor status:  Patch released
FreeBSD only:   NO

I.   Background

tcpdump is a tool for monitoring network traffic activity.

II.  Problem Description

An overflowable buffer was found in the version of tcpdump included
with FreeBSD 4.x.  Due to incorrect string length handling in the
decoding of AFS RPC packets, a remote user may be able to overflow a
buffer causing the local tcpdump process to crash.  In addition, it
may be possible to execute arbitrary code with the privileges of the
user running tcpdump, often root.

The effects of this vulnerability are similiar to those described in
advisory FreeBSD-SA-00:61.tcpdump.v1.1.

All released versions of FreeBSD prior to the correction date
including 4.3-RELEASE are vulnerable to this problem, however it does
not affect the FreeBSD 3.x branch which includes an older version of

III. Impact

Remote users can cause the local tcpdump process to crash, and may be
able to cause arbitrary code to be executed as the user running
tcpdump, often root.

IV.  Workaround

Do not use vulnerable versions of tcpdump in network environments
which may contain packets from untrusted sources.

V.   Solution

One of the following:

1) Upgrade your vulnerable FreeBSD system to 4.3-STABLE or the
RELENG_4_3 security branch after the respective correction dates.

2) FreeBSD 4.x systems prior to the correction date:

Download the patch and the detached PGP signature from the following
locations, and verify the signature using your PGP utility.

# cd /usr/src/contrib/tcpdump
# patch -p < /path/to/patch
# cd /usr/src/usr.sbin/tcpdump
# make depend && make all install

3) FreeBSD 4.3-RELEASE systems:

An experimental upgrade package is available for users who wish to
provide testing and feedback on the binary upgrade process.  This
package may be installed on FreeBSD 4.3-RELEASE systems only, and is
intended for use on systems for which source patching is not practical
or convenient.

If you use the upgrade package, feedback (positive or negative) is
requested to security-officer at so we can improve the
process for future advisories.

During the installation procedure, backup copies are made of the files
which are replaced by the package.  These backup copies will be
reinstalled if the package is removed, reverting the system to a
pre-patched state.

Two versions of the upgrade package are available, depending on
whether or not the system has openssl installed.  To verify whether
your system has openssl installed, perform the following command:

# ls /usr/bin/openssl

Possible responses:

/usr/bin/openssl       # This response indicates you have openssl present

ls: /usr/bin/openssl: No such file or directory
                       # This reponse indicates you do not have
                       # openssl present

3a) If OpenSSL is not present

# fetch
# fetch

Verify the detached PGP signature using your PGP utility.

# pkg_add security-patch-tcpdump-nossl-01.48.tgz

3b) If OpenSSL is present

# fetch
# fetch

Verify the detached PGP signature using your PGP utility.

# pkg_add security-patch-tcpdump-ssl-01.48.tgz

Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see


This is the moderated mailing list freebsd-announce.
The list contains announcements of new FreeBSD capabilities,
important events and project milestones.
See also the FreeBSD Web pages at

To Unsubscribe: send mail to majordomo at
with "unsubscribe freebsd-announce" in the body of the message

More information about the freebsd-announce mailing list