Executive brief
A vulnerability exists in tcpdump, a widely used tool for monitoring and analyzing network traffic. By sending specially crafted network packets, an attacker could cause the tool to crash or potentially execute unauthorized commands on the system running the software. This could lead to a complete system takeover or a disruption of network monitoring capabilities.
Technical details
A buffer overflow vulnerability exists in the Authentication Header (AH) parser of tcpdump versions prior to 4.9.0. The flaw is located in the ah_print() function in print-ah.c and is triggered during the decoding of AH protocol headers. A remote, unauthenticated attacker can exploit this by sending specially crafted network packets to a segment where tcpdump is performing live capture, or by providing a malicious pcap file for analysis. Successful exploitation can lead to a denial of service (application crash) or arbitrary code execution. The issue was addressed in version 4.9.0.
Affected products
- tcpdump tcpdump < 4.9.0
Timeline
- 2017-01-26: advisory: Debian security release for tcpdump 4.9.0-1
- 2017-01-27: disclosed: NVD publication date
- 2017-01-29: patched: Debian DSA-3775-1 issued
- 2017-02-21: patched: Gentoo GLSA 201702-30 issued