tcpdump bug 3.4a? by BLADI (bladi@euskalnet.net);

On receiving an ip packet with Protocol-4 and ihl=0, tcpdump enters
an infinite loop within the procedure ip_print() from file print_ip.c
This happens because the header length (ihl) equals '0' and tcpdump
tries to print the packet

I've tried the bug in diferent OS's

          
Linux:

   SuSE 6.x:
          K2.0.36  tcpdump consumes all the system memory
          K2.2.5  in less than a minute and hangs the system
          K2.2.9  or sometimes gives an error from the bus
          K2.3.2
          K2.3.5

   RedHat 5.2:  K2.?.?  tcpdump makes a segmentation fault to happen
      6.0:  K2.2.9  and it sometimes does a coredump

   Debian    K2.2.?  tcpdump makes a segmentation fault to happen
               and does a coredump

Freebsd           Segmentation fault & Coredump Thanks to: wb^3,Cagliostr
Solaris           Segmentation fault & Coredump Thanks to: acpizer
Aix             ?
Hp-UX            ?
-------------------------------------------------------------
This tests have been carried out in loopback mode, given that protocol 4
won't get through the routers. It would be interesting to perform the attack
remotely in an intranet.
But i do not have access to one.
------------------------------------------------------------------------------
Thanks to:
the channels:
#ayuda_irc,#dune,#linux,#networking,#nova y #seguridad_informática.
from irc.irc-hispano.org
Special thanks go to:
Topo[lb],^Goku^,Yogurcito,Pixie,Void,S|r_|ce,JiJ79,Unscared etc...

Thanks to Piotr Wilkin for the rip base code ;)

And big thanks go to TeMpEsT for this translation.

------
I've found two ways of solving the problem
Solution 1
execute:  tcpdump -s 24

Solution 2 Apply this little patch.
          
diff -r -p /tcpdump-3.4a6/tcpdump-3.4a6/print-ip.c /tcpdump-3.4a7/tcpdump-3.4a6/print-ip.c
*** /tcpdump-3.4a6/tcpdump-3.4a6/print-ip.c   Wed May 28 21:51:45 1997
--- /tcpdump-3.4a7/tcpdump-3.4a6/print-ip.c   Tue Oct 27 05:35:27 1998
*************** ip_print(register const u_char *bp, regi
*** 440,446 ****
                (void)printf("%s > %s: ",
                       ipaddr_string(&ip->ip_src),
                       ipaddr_string(&ip->ip_dst));
-            ip_print(cp, len);
            if (! vflag) {
                printf(" (ipip)");
                return;
--- 440,445 ----