涉及程序： tcpdump 7.3版, 8.0版, 8.1版 描述： tcpdump 存在DoS/远程代码执行缺陷 详细： tcpdump是一款网络通信分析工具。tcpdump存在两个缺陷，当对ISAKMP或BGP信息包进行分析时，将导致产生DoS攻击。利用该缺陷，远程攻击者能阻止tcpdump对网络通信进行分析。此外，tcpdump在处理攻击者发送的畸形NFS信息包时，能引发另一个缺陷，导致攻击者能在系统上执行任意代码。 受影响的系统： SuSE Linux Database Server SuSE eMail Server 3.1 SuSE eMail Server III SuSE Firewall Adminhost VPN SuSE Linux Admin-CD for Firewall SuSE Firewall on CD 2 - VPN SuSE Firewall on CD 2 SuSE Linux Live-CD for Firewall SuSE Linux Connectivity Server SuSE Linux Enterprise Server 7 for S/390 and zSeries SuSE Linux Enterprise Server 8 SuSE Linux Office Server 攻击方法： 暂无有效攻击代码 解决方案： 目前厂商已公布该缺陷补丁，请用户及时下载安装： Intel i386 Platform: SuSE-8.1: ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/tcpdump-3.7.1-198.i586.rpm 524015d3f9517311ee46eb63bc3ed42f patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/tcpdump-3.7.1-198.i586.patch.rpm 2e1d2db971cf2693e5acca0da7e3bb39 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/src/tcpdump-3.7.1-198.src.rpm 12da6755830e7614e8f81a204c546cbf SuSE-8.0: ftp://ftp.suse.com/pub/suse/i386/update/8.0/n1/tcpdump-3.6.2-322.i386.rpm 069db7de9a137b050f38c6f6a3398266 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.0/n1/tcpdump-3.6.2-322.i386.patch.rpm 3dcb00b25d35d275e2e70eba2c96fa26 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/tcpdump-3.6.2-322.src.rpm 0ed4e0db7d71f5a518173193f8a9b057 SuSE-7.3: ftp://ftp.suse.com/pub/suse/i386/update/7.3/n1/tcpdump-3.6.2-321.i386.rpm 22b2a243e3a2fbbb0288d76da5a2bccc source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/tcpdump-3.6.2-321.src.rpm d50729c39c29566371c7d708be782d43 SuSE-7.2: ftp://ftp.suse.com/pub/suse/i386/update/7.2/n1/tcpdump-3.4a6-376.i386.rpm 601bc08d351e8100767bbfd502efd44b source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/tcpdump-3.4a6-376.src.rpm af87a4ad56fc853800c6af5982899f18 SuSE-7.1: ftp://ftp.suse.com/pub/suse/i386/update/7.1/n1/tcpdump-3.4a6-375.i386.rpm a3251d65bfa05948ce3796ac9e5fdf5b source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/tcpdump-3.4a6-375.src.rpm 84ba69db15e1ff569cf674f7d61428f1 Sparc Platform: SuSE-7.3: ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n1/tcpdump-3.6.2-65.sparc.rpm 7f75bdd0c9456fe437647030bb52d92d source rpm(s): ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/tcpdump-3.6.2-65.src.rpm 4b3049a5048e5904a69d16b028220f42 AXP Alpha Platform: SuSE-7.1: ftp://ftp.suse.com/pub/suse/axp/update/7.1/n1/tcpdump-3.4a6-329.alpha.rpm 614dfa16b71456692bc1d92b9db0998b source rpm(s): ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/tcpdump-3.4a6-329.src.rpm e5a05bdbe3d5a29f0840c488e703268b PPC Power PC Platform: SuSE-7.3: ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n1/tcpdump-3.6.2-207.ppc.rpm fef9a77ba86c06d661c34646a8101b8a source rpm(s): ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/tcpdump-3.6.2-207.src.rpm 9c800d4fc891a30a4a880b55979ffe3a SuSE-7.1: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n1/tcpdump-3.4a6-317.ppc.rpm 4dd468ba517be7c7f52a8b2ac7c2beb0 source rpm(s): ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/tcpdump-3.4a6-317.src.rpm 69be109e360246794c66ed55e199ee95 附加信息： CAN-2003-0108