Executive brief
tcpdump is a widely used tool for monitoring and analyzing network traffic. A vulnerability in its Juniper PPPoE ATM parser allows an attacker to trigger a buffer overflow by sending specially crafted network packets. This could lead to a complete system crash or allow an attacker to gain unauthorized control over the system running the tool.
Technical details
A buffer overflow vulnerability exists in tcpdump versions prior to 4.9.0 within the Juniper PPPoE ATM parser (specifically in print-juniper.c:juniper_parse_header()). The flaw is triggered when the utility processes specially crafted network packets or malicious pcap files. Because tcpdump often runs with elevated privileges to capture live traffic, a successful exploit could lead to denial of service (application crash) or potentially arbitrary code execution. The vulnerability is reachable over the network without authentication or user interaction if tcpdump is performing a live capture on an affected segment. The issue was addressed in the upstream 4.9.0 release.
Affected products
- tcpdump tcpdump before 4.9.0
Timeline
- 2016-10-05: disclosed: CVE assigned
- 2017-01-26: patched: Upstream version 4.9.0 released
- 2017-01-28: advisory: NVD publication date