Executive brief
A vulnerability exists in tcpdump, a widely used tool for monitoring and analyzing network traffic. By sending specially crafted network packets, an attacker could cause the application to crash or potentially execute unauthorized code. This could lead to a disruption of network monitoring services or a compromise of the system running the tool.
Technical details
A buffer overflow vulnerability exists in the compressed Serial Line IP (SLIP) parser within tcpdump versions prior to 4.9.0. The flaw is located in the sl_if_print() function in print-sl.c and is triggered when the tool processes malformed SLIP packets. An unauthenticated remote attacker can exploit this by sending crafted packets over the network or providing a malicious pcap file for analysis. Successful exploitation can lead to a denial of service (application crash) or potentially arbitrary code execution with the privileges of the tcpdump process. The issue was addressed in version 4.9.0.
Affected products
- tcpdump tcpdump before 4.9.0
Timeline
- 2017-01-26: disclosed: Initial disclosure in Debian bug reports and upstream release 4.9.0.
- 2017-01-27: advisory: NVD publication date.
- 2017-01-29: patched: Debian security update DSA-3775-1 released.