Executive brief
tcpdump, a widely used tool for monitoring and analyzing network traffic, is vulnerable to a flaw in its ZeroMQ protocol parser. An attacker can exploit this by sending specially crafted network packets or providing a malicious capture file, potentially causing the tool to crash or allowing for unauthorized code execution. This could disrupt network monitoring operations or provide a foothold for further attacks on the system running the software.
Technical details
An integer overflow vulnerability exists in tcpdump versions prior to 4.9.0 within the ZeroMQ (ZMTP) protocol parser, specifically in the zmtp1_print_frame() function in print-zeromq.c. The flaw is triggered when the parser processes a specially crafted packet or pcap file with malformed ZeroMQ frame headers. This can result in a buffer overflow, leading to a denial of service (application crash) or potentially the execution of arbitrary code with the privileges of the tcpdump process. The vulnerability is reachable over the network without authentication if tcpdump is running in live capture mode. Users are advised to upgrade to version 4.9.0 or later.
Affected products
- tcpdump tcpdump before 4.9.0
Timeline
- 2017-01-26: patched: Debian unblock request for version 4.9.0-1
- 2017-01-27: advisory: NVD Published Date
- 2017-01-28: disclosed: Public disclosure date
- 2017-02-21: advisory: Gentoo GLSA 201702-30 issued