Executive brief
tcpdump, a widely used tool for monitoring and analyzing network traffic, is vulnerable to a memory corruption flaw when processing certain network packets. An attacker could exploit this by sending specially crafted network traffic to a system running tcpdump, potentially causing the application to crash or allowing for unauthorized code execution. This could lead to a denial of service or a compromise of the system used for network monitoring.
Technical details
A buffer overflow vulnerability exists in the Protocol Independent Multicast (PIM) parser of tcpdump versions prior to 4.9.0. The flaw is located in the `pimv2_check_checksum()` function within `print-pim.c`. A remote attacker can trigger this vulnerability by sending specially crafted PIM packets to a network interface being monitored by tcpdump in live capture mode, or by providing a malicious pcap file for offline analysis. Successful exploitation can lead to a denial of service (application crash) or potentially arbitrary code execution with the privileges of the tcpdump process. The issue is resolved in version 4.9.0.
Affected products
- tcpdump tcpdump before 4.9.0
Timeline
- 2017-01-26: disclosed: Upstream release 4.9.0 announced fixing multiple vulnerabilities.
- 2017-01-27: advisory: NVD publication date.
- 2017-01-29: patched: Debian security update released.