Executive brief
A vulnerability was found in tcpdump, a widely used tool for monitoring and analyzing network traffic. By sending specially crafted network packets, an attacker could cause the tool to crash or potentially execute malicious code. This could lead to a disruption of network monitoring services or unauthorized access to the system running the tool.
Technical details
A buffer overflow vulnerability exists in tcpdump's ARP (Address Resolution Protocol) parser, specifically within the arp_print() function in print-arp.c. The flaw is triggered when the utility processes malformed ARP packets. A remote attacker can exploit this by sending specially crafted packets over the network or providing a malicious pcap file for analysis. Successful exploitation can lead to a denial of service (application crash) or potentially arbitrary code execution with the privileges of the tcpdump process. The issue was addressed in version 4.9.0.
Affected products
- tcpdump tcpdump before 4.9.0
Timeline
- 2017-01-27: advisory: NVD published date
- 2017-01-29: patched: Debian released security update DSA-3775-1 with version 4.9.0-1