Executive brief
tcpdump is a widely used command-line tool for monitoring and analyzing network traffic. A vulnerability in its IP Payload Compression (IPComp) parser allows an attacker to send specially crafted network packets that can cause the tool to crash or potentially execute unauthorized code. This could lead to a disruption of network monitoring services or a compromise of the system running the analysis tool.
Technical details
A buffer overflow vulnerability exists in the IPComp (IP Payload Compression) protocol parser within tcpdump versions prior to 4.9.0. The flaw is located in the ipcomp_print() function within the print-ipcomp.c source file. An attacker can exploit this by sending specially crafted IPComp packets to a network segment where tcpdump is performing live capture, or by providing a malicious pcap file for analysis. Successful exploitation can result in a process crash (Denial of Service) or potentially arbitrary code execution with the privileges of the tcpdump user. The issue is addressed in version 4.9.0.
Affected products
- tcpdump tcpdump before 4.9.0
Timeline
- 2017-01-26: disclosed: Initial disclosure in Debian bug reports and upstream release notes.
- 2017-01-27: advisory: NVD publication date.
- 2017-01-29: patched: Debian security update DSA-3775-1 released.