Executive brief
tcpdump is a widely used command-line tool for monitoring and analyzing network traffic. A vulnerability in its Real-time Transport Protocol (RTP) parser allows an attacker to send specially crafted network packets that can cause the tool to crash or potentially execute unauthorized code. This could lead to a denial of service for network monitoring operations or allow an attacker to gain a foothold on the system running the analysis.
Technical details
A buffer overflow vulnerability exists in the RTP (Real-time Transport Protocol) parser of tcpdump versions prior to 4.9.0. The flaw is located in the rtp_print() function in print-udp.c and is triggered when the tool attempts to parse malformed RTP packets. An attacker can exploit this by sending specially crafted packets over the network to a segment where tcpdump is performing live capture, or by providing a malicious pcap file for offline analysis. Successful exploitation can lead to a denial of service (application crash) or potentially arbitrary code execution with the privileges of the user running tcpdump. The vulnerability was addressed in version 4.9.0.
Affected products
- tcpdump tcpdump before 4.9.0
Timeline
- 2017-01-26: other: Debian unblock request for version 4.9.0-1
- 2017-01-27: advisory: NVD Published Date
- 2017-01-29: patched: Debian security update DSA-3775-1 released
- 2017-02-21: patched: Gentoo security update GLSA 201702-30 released