Version 3.5.2 fixed a
buffer overflow vulnerability in all prior versions. However,
newer versions, including 3.6.2, are vulnerable to another
buffer overflow in the AFS RPC functions that was reported by
Nick Cleaton.
(First LWN
report: May 9).
Both problems appear to have been reported and fixed in FreeBSD some months
ago. The CIAC
report on the vulnerability in versions prior to 3.5.2 is dated October
31, 2000. Nick Cleaton's FreeBSD
security advisory on the AFS RPC bug, and reference to a fix for
FreeBSD, is dated July, 17, 2001. Tcpdump 3.7 was released on January 21,
2002.
