Executive brief
tcpdump is a widely used command-line tool for monitoring and analyzing network traffic. A vulnerability in its RTCP protocol parser allows an attacker to cause a system crash or potentially execute unauthorized code by sending specially crafted network packets. This could lead to a disruption of network monitoring services or a compromise of the system running the tool.
Technical details
A buffer overflow vulnerability exists in the RTCP (Real-time Control Protocol) parser within tcpdump versions prior to 4.9.0. The flaw is located in the rtcp_print() function in print-udp.c and is triggered by improper bounds checking when processing UDP-encapsulated RTCP packets. A remote, unauthenticated attacker can exploit this by sending specially crafted packets to a network segment being monitored by tcpdump in live capture mode, or by providing a malicious pcap file for offline analysis. Successful exploitation can lead to a denial of service (application crash) or the execution of arbitrary code with the privileges of the tcpdump process. The issue was addressed in version 4.9.0.
Affected products
- tcpdump tcpdump before 4.9.0
Timeline
- 2017-01-27: advisory: NVD publication date
- 2017-01-29: patched: Debian released fixed version 4.9.0-1