Executive brief
tcpdump, a widely used tool for monitoring and analyzing network traffic, is vulnerable to a buffer overflow when processing MPLS packets. An attacker can exploit this by sending specially crafted network traffic or providing a malicious capture file, potentially leading to a complete system takeover or a service crash. This affects organizations using tcpdump for network troubleshooting, security monitoring, or automated traffic analysis.
Technical details
A buffer overflow vulnerability exists in tcpdump's MPLS (Multi-Protocol Label Switching) parser, specifically within the mpls_print() function in print-mpls.c. The flaw is triggered by improper bounds checking when processing MPLS-encapsulated packets. A remote, unauthenticated attacker can exploit this by sending specially crafted packets to a network segment where tcpdump is performing live capture, or by tricking a user into opening a malicious pcap file. Successful exploitation can lead to arbitrary code execution with the privileges of the tcpdump process or a denial-of-service (DoS) condition via a process crash. The vulnerability is addressed in tcpdump version 4.9.0.
Affected products
- tcpdump tcpdump before 4.9.0
Timeline
- 2017-01-26: disclosed: Vulnerability reported in Debian bug tracking system
- 2017-01-27: advisory: NVD published date
- 2017-01-29: patched: Debian released security update DSA-3775-1