<?xml version="1.0" encoding="UTF-8"?>

<oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:red-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
  <generator>
    <oval:product_name>Red Hat Errata System</oval:product_name>
    <oval:schema_version>5.3</oval:schema_version>
    <oval:timestamp>2008-01-23T07:18:05</oval:timestamp>
  </generator>

  <definitions>
    <definition id="oval:com.redhat.rhsa:def:20040219" version="302" class="patch">
      <metadata>
        <title>RHSA-2004:219: tcpdump security update
        (Low)
	</title>
  	<affected family="unix">
        <platform>Red Hat Enterprise Linux 3</platform>
        </affected>
        <reference source="RHSA" ref_id="RHSA-2004:219-02" ref_url="https://rhn.redhat.com/errata/RHSA-2004-219.html"/>
	<description>Tcpdump is a command-line tool for monitoring network traffic. 

Tcpdump v3.8.1 and earlier versions contained multiple flaws in the
packet display functions for the ISAKMP protocol.  Upon receiving
specially crafted ISAKMP packets, TCPDUMP would try to read beyond
the end of the packet capture buffer and subsequently crash.

Users of tcpdump are advised to upgrade to these erratum packages, which
contain backported security patches and are not vulnerable to these issues.</description>

<!-- ~~~~~~~~~~~~~~~~~~~~   advisory details   ~~~~~~~~~~~~~~~~~~~ -->

<advisory from="secalert@redhat.com">
        <severity>Low</severity>
        <rights>Copyright 2004 Red Hat, Inc.</rights>
        <issued date="2004-05-26"/>
        <updated date="2004-05-26"/>
        <cve href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0183">CVE-2004-0183</cve>
        <cve href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0184">CVE-2004-0184</cve>
  	<affected_cpe_list>
        <cpe>cpe://redhat:enterprise_linux:3</cpe>
        </affected_cpe_list>
</advisory>
      </metadata>  <criteria operator="AND">
    <criterion test_ref="oval:com.redhat.rhsa:tst:20040219001" comment="Red Hat Enterprise Linux 3 is installed"/>
    <criteria operator="OR">
            <criteria operator="AND">

            <criterion test_ref="oval:com.redhat.rhsa:tst:20040219002" comment="tcpdump is earlier than 14:3.7.2-7.E3.2"/>
            <criterion test_ref="oval:com.redhat.rhsa:tst:20040219003" comment="tcpdump is signed with Red Hat security key"/>
            </criteria>
            <criteria operator="AND">

            <criterion test_ref="oval:com.redhat.rhsa:tst:20040219004" comment="libpcap is earlier than 14:0.7.2-7.E3.2"/>
            <criterion test_ref="oval:com.redhat.rhsa:tst:20040219005" comment="libpcap is signed with Red Hat security key"/>
            </criteria>
    </criteria>
  </criteria>

    </definition>
  </definitions>
  <tests>
    <!-- ~~~~~~~~~~~~~~~~~~~~~   rpminfo tests   ~~~~~~~~~~~~~~~~~~~~~ --><rpminfo_test id="oval:com.redhat.rhsa:tst:20040219001" version="302" comment="redhat-release is version 3" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.redhat.rhsa:obj:20040219001"/>
<state state_ref="oval:com.redhat.rhsa:ste:20040219001"/>
</rpminfo_test>
<rpminfo_test id="oval:com.redhat.rhsa:tst:20040219002" version="302" comment="tcpdump is earlier than 14:3.7.2-7.E3.2" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.redhat.rhsa:obj:20040219002"/>
<state state_ref="oval:com.redhat.rhsa:ste:20040219002"/>
</rpminfo_test>
<rpminfo_test id="oval:com.redhat.rhsa:tst:20040219003" version="302" comment="tcpdump is signed with Red Hat security key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.redhat.rhsa:obj:20040219002"/>
<state state_ref="oval:com.redhat.rhsa:ste:20040219003"/>
</rpminfo_test>
<rpminfo_test id="oval:com.redhat.rhsa:tst:20040219004" version="302" comment="libpcap is earlier than 14:0.7.2-7.E3.2" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.redhat.rhsa:obj:20040219003"/>
<state state_ref="oval:com.redhat.rhsa:ste:20040219004"/>
</rpminfo_test>
<rpminfo_test id="oval:com.redhat.rhsa:tst:20040219005" version="302" comment="libpcap is signed with Red Hat security key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.redhat.rhsa:obj:20040219003"/>
<state state_ref="oval:com.redhat.rhsa:ste:20040219003"/>
</rpminfo_test>

  </tests>
  <objects>
    <!-- ~~~~~~~~~~~~~~~~~~~~   rpminfo objects   ~~~~~~~~~~~~~~~~~~~~ --><rpminfo_object id="oval:com.redhat.rhsa:obj:20040219001" version="302" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
  <name>redhat-release</name>
</rpminfo_object>
<rpminfo_object id="oval:com.redhat.rhsa:obj:20040219002" version="302" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
  <name>tcpdump</name>
</rpminfo_object>
<rpminfo_object id="oval:com.redhat.rhsa:obj:20040219003" version="302" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
  <name>libpcap</name>
</rpminfo_object>

  </objects>
  <states>
    <!-- ~~~~~~~~~~~~~~~~~~~~   rpminfo states   ~~~~~~~~~~~~~~~~~~~~~ --><rpminfo_state id="oval:com.redhat.rhsa:ste:20040219001" version="302" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
  <version operation="pattern match">^3[^[:digit:]]</version>
</rpminfo_state>
<rpminfo_state id="oval:com.redhat.rhsa:ste:20040219002" version="302" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
  <evr datatype="evr_string" operation="less than">14:3.7.2-7.E3.2</evr>
</rpminfo_state>
<rpminfo_state id="oval:com.redhat.rhsa:ste:20040219003" version="302" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
  <signature_keyid operation="equals">219180cddb42a60e</signature_keyid>
</rpminfo_state>
<rpminfo_state id="oval:com.redhat.rhsa:ste:20040219004" version="302" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
  <evr datatype="evr_string" operation="less than">14:0.7.2-7.E3.2</evr>
</rpminfo_state>

  </states>
</oval_definitions>