Executive brief
tcpdump, a widely used tool for monitoring and analyzing network traffic, contains a vulnerability in its TCP packet processing component. An attacker can exploit this by sending specially crafted network traffic to a system running tcpdump, potentially causing the application to crash or allowing for unauthorized code execution. This could disrupt network monitoring operations or provide a foothold for further attacks on the system.
Technical details
A buffer overflow vulnerability exists in the TCP parser of tcpdump versions prior to 4.9.0, specifically within the tcp_print() function in print-tcp.c. The flaw is triggered when the utility attempts to parse malformed TCP packets. A remote attacker can exploit this by sending specially crafted packets over the network to a system where tcpdump is performing live capture, or by tricking a user into opening a malicious pcap file. Successful exploitation can lead to a denial of service (application crash) or potentially arbitrary code execution with the privileges of the tcpdump process. The issue was addressed in version 4.9.0.
Affected products
- tcpdump tcpdump before 4.9.0
Timeline
- 2017-01-26: disclosed: Initial disclosure in Debian bug reports
- 2017-01-27: advisory: NVD publication date
- 2017-01-29: patched: Debian security update released