Executive brief
A vulnerability exists in tcpdump, a widely used tool for monitoring and analyzing network traffic. By sending specially crafted wireless network packets, an attacker could cause the tool to crash or potentially execute unauthorized code. This could disrupt network monitoring operations or allow an attacker to gain a foothold on the system running the analysis software.
Technical details
A buffer overflow vulnerability exists in tcpdump's IEEE 802.11 (wireless) protocol parser, specifically within the 'ieee802_11_radio_print()' function in 'print-802_11.c'. The flaw is triggered when tcpdump processes a malformed packet or pcap file containing crafted 802.11 radio headers. A remote attacker can exploit this by sending malicious packets to a network segment where tcpdump is performing live capture or by tricking a user into opening a crafted capture file. Successful exploitation can lead to a denial of service (application crash) or arbitrary code execution with the privileges of the tcpdump process. The issue is resolved in version 4.9.0.
Affected products
- tcpdump tcpdump before 4.9.0
Timeline
- 2016-09-26: disclosed: Vulnerability identified (based on CVE year)
- 2017-01-18: patched: Fixed in upstream version 4.9.0
- 2017-01-28: advisory: NVD advisory published