Is CVE-2016-7938 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-7938 being exploited in the wild.

How severe is CVE-2016-7938?

Critical severity, with a CVSS score of 9.8, published 28 January 2017.

Is there a fix for CVE-2016-7938?

A patch was published on 2017-01-26: Debian unblock request for version 4.9.0-1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-7938 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-7938?

Check whether you run Tcpdump. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-7938: tcpdump integer overflow in ZeroMQ parser

CVE-2016-7938 · Severity: critical · CVSS 9.8 · Published 2017-01-28

tcpdump, a widely used tool for monitoring and analyzing network traffic, is vulnerable to a flaw in its ZeroMQ protocol parser. An attacker can exploit this by sending specially crafted network packets or providing a malicious capture file, potentially causing the tool to crash or allowing for unauthorized code execution. This could disrupt network monitoring operations or provide a foothold for further attacks on the system running the software.

Technologies: Tcpdump. Vendors: Tcpdump.

Quick answers

Is CVE-2016-7938 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-7938 being exploited in the wild.
How severe is CVE-2016-7938?: Critical severity, with a CVSS score of 9.8, published 28 January 2017.
Which products and versions are affected?: tcpdump tcpdump before 4.9.0.
Is there a fix for CVE-2016-7938?: A patch was published on 2017-01-26: Debian unblock request for version 4.9.0-1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-7938 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-7938?: Check whether you run Tcpdump. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow vulnerability exists in tcpdump versions prior to 4.9.0 within the ZeroMQ (ZMTP) protocol parser, specifically in the zmtp1_print_frame() function in print-zeromq.c. The flaw is triggered when the parser processes a specially crafted packet or pcap file with malformed ZeroMQ frame headers. This can result in a buffer overflow, leading to a denial of service (application crash) or potentially the execution of arbitrary code with the privileges of the tcpdump process. The vulnerability is reachable over the network without authentication if tcpdump is running in live capture mode. Users are advised to upgrade to version 4.9.0 or later.

Affected products

tcpdump tcpdump before 4.9.0

Timeline

2017-01-26: patched: Debian unblock request for version 4.9.0-1
2017-01-27: advisory: NVD Published Date
2017-01-28: disclosed: Public disclosure date
2017-02-21: advisory: Gentoo GLSA 201702-30 issued

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.