Issued:

2013-11-20

Updated:

2013-11-20

RHBA-2013:1727 - libpcap bug fix and enhancement update

Synopsis

libpcap bug fix and enhancement update

Type/Severity

Bug Fix Advisory

Topic

Updated libpcap packages that fix several bugs and add various enhancements are now available for Red Hat Enterprise Linux 6.

Description

The Packet Capture library (pcap) provides a high level interface to packet capture systems. All packets on the network, even those destined for other hosts, are accessible through this mechanism. It also supports saving captured packets to a 'savefile', and reading packets from a 'savefile'. libpcap provides implementation-independent access to the underlying packet capture facility provided by the operating system.

The libpcap packages have been upgraded to upstream version 1.4.1, which provides a number of bug fixes and enhancements over the previous version. (BZ#916749)

This update also fixes the following bugs:

• Previously, the libpcap library generated wrong filtering code for Berkeley Packet Filter (BPF) infrastructure. As a consequence, the in-kernel packet filter was discarding some packets which should have been received by userspace process. Moreover, the tcpdump utility produced incorrect output when a fragmentation of IPv6 packet occurred because of the MTUlink. To fix this bug, the code which deals with BPF filter generation has been fixed to check for fragmentation headers in IPv6 PDUs before checking for the final protocol. As a result, the kernel filter no longer discards IPv6 fragments when source-site fragmentation occurs during IPv6 transmission and tcpdump receives all packets. (BZ#723108)

• Prior to this update, libpcap was unable to open a capture device with small values of SnapLen, which caused libpcap to return an error code and tcpdump to exit prematurely. Calculation of frames for memory mapping packet capture mechanism has been adjusted not to truncate packets to smaller values than actual SnapLen, thus fixing the bug. As a result, libpcap no longer returns errors when trying to open a capture device with small values of SnapLen, and applications using libpcap are able to process packets. (BZ#731789)

Users of libpcap are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

Affected Products

Updated Packages

• libpcap-devel-1.4.0-1.20130826git2dbcaa1.el6.s390x.rpm
• libpcap-devel-1.4.0-1.20130826git2dbcaa1.el6.ppc.rpm
• libpcap-1.4.0-1.20130826git2dbcaa1.el6.s390x.rpm
• libpcap-debuginfo-1.4.0-1.20130826git2dbcaa1.el6.i686.rpm
• libpcap-devel-1.4.0-1.20130826git2dbcaa1.el6.x86_64.rpm
• libpcap-1.4.0-1.20130826git2dbcaa1.el6.x86_64.rpm
• libpcap-debuginfo-1.4.0-1.20130826git2dbcaa1.el6.ppc.rpm
• libpcap-devel-1.4.0-1.20130826git2dbcaa1.el6.ppc64.rpm
• libpcap-1.4.0-1.20130826git2dbcaa1.el6.src.rpm
• libpcap-1.4.0-1.20130826git2dbcaa1.el6.ppc64.rpm
• libpcap-devel-1.4.0-1.20130826git2dbcaa1.el6.s390.rpm
• libpcap-debuginfo-1.4.0-1.20130826git2dbcaa1.el6.x86_64.rpm
• libpcap-1.4.0-1.20130826git2dbcaa1.el6.ppc.rpm
• libpcap-debuginfo-1.4.0-1.20130826git2dbcaa1.el6.s390x.rpm
• libpcap-debuginfo-1.4.0-1.20130826git2dbcaa1.el6.ppc64.rpm
• libpcap-devel-1.4.0-1.20130826git2dbcaa1.el6.i686.rpm
• libpcap-1.4.0-1.20130826git2dbcaa1.el6.i686.rpm
• libpcap-debuginfo-1.4.0-1.20130826git2dbcaa1.el6.s390.rpm
• libpcap-1.4.0-1.20130826git2dbcaa1.el6.s390.rpm

Fixes

• This content is not included.BZ - 723108
• This content is not included.BZ - 731789

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.