Issued:
2009-11-26
Updated:
2010-04-07

RHBA-2009:1605 - tcpdump bug fix update

Synopsis

tcpdump bug fix update

Type/Severity

Bug Fix Advisory

Topic

Updated tcpdump packages that fix two bugs are now available for Red Hat Enterprise Linux 5.

[Updated 7 April 2010] These packages have also been made available in the following child channels: Red Hat Enterprise Linux Desktop Client 5 for x86, and Red Hat Desktop Workstation Client 5 for x86. No changes have been made to the packages.

Description

The tcpdump tool is a command line utility for monitoring network traffic.

These updated packages resolve the following issues:

  • when run on 64-bit architectures, tcpslice read the timestamps in pcap files as 64-bit values despite them always been stored as 32-bit. Consequently, rather than extracting packet-trace file portions as expected, tcpslice returned a "couldn't find final packet in file" error. With this update tcpslice reads pcap timestamps as 32-bit values and now works as expected on 64-bit architectures. (BZ#485670)

  • running "tcpdump -i [n]", where [n] was an invalid interface index, caused tcpdump to SEGFAULT rather than return an "Invalid adapter index" error. tcpdump now explicitly checks for the last entry in the device list. If the [n] specified is higher than this entry, it returns "Invalid adapter index" as expected and does not crash. (BZ#497819)

All tcpdump users should upgrade to these updated packages, which resolve these issues.

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at This content is not included.http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

ProductVersionArch
Red Hat Enterprise Linux for Power, big endian5ppc
Red Hat Enterprise Linux for IBM z Systems5s390x
Red Hat Enterprise Linux Workstation5x86_64
Red Hat Enterprise Linux Workstation5i386
Red Hat Enterprise Linux Server5x86_64
Red Hat Enterprise Linux Server5ia64
Red Hat Enterprise Linux Server5i386
Red Hat Enterprise Linux Server from RHUI5x86_64
Red Hat Enterprise Linux Server from RHUI5i386
Red Hat Enterprise Linux Desktop5x86_64
Red Hat Enterprise Linux Desktop5i386

Updated Packages

  • libpcap-devel-0.9.4-15.el5.s390x.rpm
  • libpcap-0.9.4-15.el5.ppc.rpm
  • tcpdump-3.9.4-15.el5.i386.rpm
  • libpcap-0.9.4-15.el5.s390x.rpm
  • libpcap-devel-0.9.4-15.el5.ppc64.rpm
  • arpwatch-2.1a13-22.el5.ppc.rpm
  • libpcap-0.9.4-15.el5.i386.rpm
  • arpwatch-2.1a13-22.el5.s390x.rpm
  • libpcap-devel-0.9.4-15.el5.s390.rpm
  • arpwatch-2.1a13-22.el5.i386.rpm
  • tcpdump-3.9.4-15.el5.s390x.rpm
  • libpcap-devel-0.9.4-15.el5.i386.rpm
  • libpcap-0.9.4-15.el5.ppc64.rpm
  • tcpdump-3.9.4-15.el5.ppc.rpm
  • arpwatch-2.1a13-22.el5.x86_64.rpm
  • libpcap-devel-0.9.4-15.el5.ppc.rpm
  • libpcap-0.9.4-15.el5.ia64.rpm
  • libpcap-0.9.4-15.el5.x86_64.rpm
  • tcpdump-3.9.4-15.el5.src.rpm
  • tcpdump-3.9.4-15.el5.x86_64.rpm
  • libpcap-devel-0.9.4-15.el5.ia64.rpm
  • libpcap-0.9.4-15.el5.s390.rpm
  • tcpdump-3.9.4-15.el5.ia64.rpm
  • libpcap-devel-0.9.4-15.el5.x86_64.rpm
  • arpwatch-2.1a13-22.el5.ia64.rpm

Fixes

CVEs

(none)

References

(none)

Additional information