Executive brief
Tcpdump, a widely used tool for monitoring and analyzing network traffic, contains a vulnerability in its ATM protocol parser. An attacker can exploit this by sending specially crafted network traffic or providing a malicious capture file, potentially causing the tool to crash or allowing for unauthorized code execution. This could disrupt network monitoring operations or allow an attacker to gain a foothold on the system running the analysis.
Technical details
A buffer overflow vulnerability exists in tcpdump versions prior to 4.9.0 within the ATM (Asynchronous Transfer Mode) parser, specifically in the oam_print() function located in print-atm.c. The flaw is triggered when the utility attempts to parse malformed OAM (Operations, Administration, and Maintenance) cells. An unauthenticated remote attacker can exploit this by sending specially crafted packets to a network interface being monitored by tcpdump in live capture mode, or by tricking a user into opening a malicious pcap file. Successful exploitation can lead to a denial-of-service (DoS) condition via application crash or potentially arbitrary code execution. The issue was addressed in the upstream release of tcpdump 4.9.0.
Affected products
- tcpdump tcpdump < 4.9.0
Timeline
- 2017-01-26: patched: Upstream release 4.9.0 fixes the issue.
- 2017-01-27: advisory: NVD publication date.