CVE-2005-1267

The bgp_update_print function in tcpdump 3.x does not properly handle a -1 return value from the decode_prefix4 function, which allows remote attackers to cause a denial of service (infinite loop) via a crafted BGP packet.

Score

CVSS 2.0 5.0 Medium

Status

Modified - secalert@redhat.com

Published

2005-06-10

Last modified

2024-08-07

Affected products

• Linux (Gentoo)
• Tcpdump (Lbl)
• Mandrake Linux (Mandrakesoft)
• Fedora Core (Redhat)
• Secure Linux (Trustix)

References

• http://secunia.com/advisories/15634/
• http://secunia.com/advisories/17118
• http://www.debian.org/security/2005/dsa-854
• http://www.redhat.com/archives/fedora-announce-list/2005-June/msg00007.html
• http://www.redhat.com/support/errata/RHSA-2005-505.html
• http://www.securityfocus.com/archive/1/430292/100/0/threaded
• http://www.securityfocus.com/bid/13906
• http://www.trustix.org/errata/2005/0028/
• https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=159208
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11148