Executive brief
A vulnerability exists in tcpdump, a widely used tool for monitoring and analyzing network traffic. By sending specially crafted network packets, an attacker could cause the tool to crash or potentially execute unauthorized code on the system running the analysis. This could lead to a disruption of network monitoring services or a full system compromise.
Technical details
A buffer overflow vulnerability exists in the Classical IP over ATM (CIP) parser within tcpdump versions prior to 4.9.0. The flaw is located in the cip_if_print() function in print-cip.c. A remote attacker can exploit this by sending specially crafted network packets or providing a malicious pcap file for analysis. Successful exploitation can lead to a denial of service (application crash) or arbitrary code execution with the privileges of the user running tcpdump. The issue was addressed in version 4.9.0 by improving bounds checking during packet parsing.
Affected products
- Tcpdump Project tcpdump before 4.9.0
Timeline
- 2017-01-26: patched: Fixed in upstream version 4.9.0
- 2017-01-28: disclosed: NVD publication date