SB2019100318 - Multiple vulnerabilities in libpcap

Description

This security bulletin contains information about 6 secuirty vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2019-15165)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the sf-pcapng.c in libpcap when processing the PHB header length before allocating memory. A remote attacker can pass specially crafted data to the application that uses the vulnerable library, trigger memory corruption and perform denial of service (DoS) attack.

2) Out-of-bounds read (CVE-ID: CVE-2018-16301)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in libpcap when during pcapng reading. A remote attacker can pass specially crafted data to the application that uses the affected library, trigger out-of-bounds read error and read contents of memory on the system or crash the application.

3) Input validation error (CVE-ID: CVE-2019-15161)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input within the rpcapd/daemon.c in libpcap. A remote attacker can send specially crafted request to the application and gain access to sensitive information.

4) Insufficient verification of data authenticity (CVE-ID: CVE-2019-15162)

The vulnerability allows a remote attacker to enumerate users on the system.

The vulnerability exists within the rpcapd/daemon.c in libpcap on non-Windows platforms due to the application provides details about failed authenticated attempts. A remote attacker can enumerate users on the system.

5) NULL pointer dereference (CVE-ID: CVE-2019-15163)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dreference error within the rpcapd/daemon.c in libpcap if a crypt() call fails. A remote attacker can perform a denial of service (DoS) attack.

6) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2019-15164)

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input within the rpcapd/daemon.c in libpcap when processing URL as a capture source. A remote attacker can trick the victim to use a specially crafted URL to extract information.

Remediation

Install update from vendor's website.

References

• https://github.com/the-tcpdump-group/libpcap/blob/libpcap-1.9/CHANGES
• https://github.com/the-tcpdump-group/libpcap/commit/87d6bef033062f969e70fa40c43dfd945d5a20ab
• https://github.com/the-tcpdump-group/libpcap/commit/a5a36d9e82dde7265e38fe1f87b7f11c461c29f6
• https://www.tcpdump.org/public-cve-list.txt
• https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
• https://github.com/the-tcpdump-group/libpcap/commit/617b12c0339db4891d117b661982126c495439ea
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5P5K3DQ4TFSZBDB3XN4CZNJNQ3UIF3D3/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GBIEKWLNIR62KZ5GA7EDXZS52HU6OE5F/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UZTIPUWABYUE5KQOLCKAW65AUUSB7QO6/
• https://github.com/the-tcpdump-group/libpcap/commit/484d60cbf7ca4ec758c3cbb8a82d68b244a78d58
• https://github.com/the-tcpdump-group/libpcap/commit/437b273761adedcbd880f714bfa44afeec186a31
• https://github.com/the-tcpdump-group/libpcap/commit/33834cb2a4d035b52aa2a26742f832a112e90a0a