Executive brief
tcpdump is a widely used tool for monitoring and analyzing network traffic. A vulnerability in its Q.933 protocol parser allows an attacker to send specially crafted network packets that can cause the tool to crash or potentially execute unauthorized code. This could lead to a complete disruption of network monitoring capabilities or allow an attacker to gain control over the system running the tool.
Technical details
A buffer overflow vulnerability exists in tcpdump's Q.933 parser (specifically in print-fr.c:q933_print()) due to improper bounds checking when processing Frame Relay Q.933 packets. A remote attacker can exploit this by sending specially crafted network traffic to a segment where tcpdump is performing live capture, or by providing a malicious pcap file for offline analysis. Successful exploitation can lead to a denial of service (application crash) or arbitrary code execution with the privileges of the tcpdump process. This issue was addressed in version 4.9.0.
Affected products
- tcpdump tcpdump before 4.9.0
Timeline
- 2016-10-24: disclosed: CVE assigned
- 2017-01-26: patched: Fixed in tcpdump version 4.9.0-1 in Debian unstable
- 2017-01-28: advisory: NVD publication date