| Summary: | tcpdump several new security issues fixed in 4.9.2 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | lewyssmith, mageia, sysadmin-bugs |
| Version: | 6 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA5TOO MGA5-64-OK MGA6-64-OK | ||
| Source RPM: | tcpdump-4.9.1-1.mga5.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2017-09-05 03:15:18 CEST
David Walser
2017-09-05 03:15:26 CEST
Whiteboard:
(none) =>
MGA5TOO Installed and tested without issues. Tests: - Dumping random net activity; - Filtering some (existing and new) pcap files; - Capturing to pcap files. Didn't do any CVE related tests but for normal usage it seems to be working. System: Mageia 5, x86_64, Intel CPU, Realtek RTL8168c/8111c Ethernet. $ rpm -q tcpdump tcpdump-4.9.2-1.mga5 $ uname -a Linux marte 4.4.82-desktop-1.mga5 #1 SMP Sun Aug 13 18:03:58 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux $ lspcidrake | grep Ethernet r8169 : Realtek Semiconductor Co., Ltd.|RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller [NETWORK_ETHERNET] (rev: 02) dmesg | egrep -o 'RTL.*(8111|8168|8411)' RTL8168c/8111 Whiteboard:
MGA5TOO =>
MGA5TOO MGA5-64-OK Advisory made from Comment 0. No references. Included *all* the CVEs cited; it should be easy to remove any that prove superflous. @David : let me know if you want it changed. Whiteboard:
MGA5TOO MGA5-64-OK =>
MGA5TOO MGA5-64-OK advisory Moving 'advisory' from whiteboard to keywords now that madb has been updated to handle that keyword. Keywords:
(none) =>
advisory Testing M6/64 BEFORE the update, installed: tcpdump-4.9.1-1.mga6.x86_64.rpm (already in 'updates'). It has a good man page. With just a single ethernet connection, did (you seem to need to be root to run it): # tcpdump tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on enp4s0, link-type EN10MB (Ethernet), capture size x bytes and generated traffic by refreshing tabs open in a browser. It pours out on the console, showing a lot of disconcerting exchanges... ^C810 packets captured 1159 packets received by filter 349 packets dropped by kernel # tcpdump -w tmp/tcpdump tcpdump: listening on enp4s0, link-type EN10MB (Ethernet), capture size x bytes outputs to a file. This is binary, not directly viewable; apparently .pcap format. ^C905 packets captured 905 packets received by filter 0 packets dropped by kernel # tcpdump -r tmp/tcpdump | less Reads it back, intelligibly. AFTER update to: tcpdump-4.9.2-1.mga6 Ran through the same sequence. Without understanding the significance of what is logged, it all looks sensible and OK. With filtering possibilities, this looks a handy interface monitor. Perhaps better usage would be with the options: -v a bit more info -l Make stdout line buffered. Useful if you want to see the data while capturing it. E.g., # tcpdump -l | tee <file> Validating as we have a test for both releases. Keywords:
(none) =>
validated_update An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2017-0335.html Status:
NEW =>
RESOLVED |