Executive brief
tcpdump is a widely used command-line tool for monitoring and analyzing network traffic. A vulnerability in its OTV protocol parser allows an attacker to send specially crafted network packets that can cause the tool to crash or potentially allow the execution of unauthorized code. This could lead to a disruption of network monitoring services or a compromise of the system running the tool.
Technical details
A buffer overflow vulnerability exists in tcpdump's Overlay Transport Virtualization (OTV) protocol parser. The flaw is located in the otv_print() function in print-otv.c and is triggered when processing malformed OTV packets. A remote, unauthenticated attacker can exploit this by sending crafted packets to a network segment where tcpdump is performing live capture or by providing a malicious pcap file for offline analysis. Successful exploitation can result in a denial of service (application crash) or potentially arbitrary code execution. The issue was addressed in version 4.9.0.
Affected products
- tcpdump tcpdump < 4.9.0
Timeline
- 2017-01-26: disclosed: Upstream release 4.9.0 announced fixing 41 vulnerabilities
- 2017-01-27: advisory: NVD publication date
- 2017-01-29: patched: Debian security update released