Updated tcpdump packages fix various vulnerabilities

Updated tcpdump, libpcap, and arpwatch packages for iSeries and pSeries fix
various vulnerabilities.

Tcpdump is a command-line tool for monitoring network traffic.

The Red Hat tcpdump packages advertise that by default tcpdump will drop
permissions to user 'pcap'. Due to a compilation error this did not
happen, and tcpdump would run as root unless the '-U' flag was specified.

Users of tcpdump are advised to upgrade to these errata packages, which
are compiled so that by default tcpdump will drop privileges to the
'pcap' user.

The BGP decoding routines in tcpdump before 3.6.2 used incorrect bounds
checking when copying data, which allows remote attackers to cause a denial
of service and possibly execute arbitrary code (as the 'pcap' user).

The RADIUS decoder in tcpdump 3.6.2 and earlier allows remote attackers to
cause a denial of service (crash) via an invalid RADIUS packet with a
header length field of 0. This causes tcpdump to generate data within an
infinite loop.

A vulnerability in tcpdump before 3.7.2 is related to an inability to
handle unknown RADIUS attributes properly, and allows remote attackers to
cause a denial of service (infinite loop).

The ISAKMP parser in tcpdump 3.6 through 3.7.1 allows remote attackers to
cause a denial of service (CPU consumption) via a malformed ISAKMP packet
to UDP port 500, causing tcpdump to enter an infinite loop.

Versions of tcpdump up to and including 3.6.2 have a buffer overflow that
can be triggered when tracing the network by a bad NFS packet. This issue
was found by David Woodhouse of Red Hat.

Users of tcpdump are advised to upgrade to these errata packages, which
contain patches to correct these issues.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

Please note that this update is available via Red Hat Network. To use Red
Hat Network, launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0380
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1350
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0093
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0108
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0145
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0194
http://www.idefense.com/advisory/02.27.03.txt

arpwatch, buffer, overflow, tcpdump