Executive brief
tcpdump is a widely used command-line tool for monitoring and analyzing network traffic. A vulnerability in its Ethernet parser allows an attacker to potentially crash the application or execute unauthorized code by sending specially crafted network packets. This could lead to a disruption of network monitoring services or a compromise of the system running the tool.
Technical details
A buffer overflow vulnerability exists in tcpdump versions prior to 4.9.0 within the Ethernet protocol parser. The flaw is located in the ethertype_print() function in print-ether.c and is triggered when processing malformed Ethernet frames. A remote attacker can exploit this by sending specially crafted packets to a network segment where tcpdump is performing live capture, or by tricking a user into opening a malicious pcap file. Successful exploitation can lead to a denial of service (application crash) or potentially arbitrary code execution. The issue was addressed in the upstream release of tcpdump 4.9.0.
Affected products
- tcpdump tcpdump before 4.9.0
Timeline
- 2017-01-27: advisory: NVD published date
- 2017-01-29: patched: Debian released security update DSA-3775-1