Executive brief
tcpdump is a widely used command-line tool for monitoring and analyzing network traffic. A vulnerability in its SNMP protocol parser allows an attacker to send specially crafted network packets that can cause the tool to crash or potentially allow the attacker to take control of the system. This could lead to a loss of network monitoring capabilities or unauthorized access to sensitive data on the system running the tool.
Technical details
A buffer overflow vulnerability exists in the SNMP parser of tcpdump versions prior to 4.9.0. The flaw is located in the 'asn1_parse' function within 'print-snmp.c'. A remote attacker can exploit this by sending specially crafted SNMP packets to a network segment where tcpdump is performing live capture, or by tricking a user into opening a malicious pcap file. Successful exploitation can lead to a denial of service (application crash) or potentially arbitrary code execution with the privileges of the tcpdump process. The issue was addressed in the upstream release of version 4.9.0.
Affected products
- tcpdump tcpdump < 4.9.0
Timeline
- 2017-01-26: disclosed: Initial upstream security release announcement
- 2017-01-28: advisory: NVD publication date
- 2017-01-29: patched: Debian security update released
- 2017-02-21: patched: Gentoo security update released
- 2017-08-01: patched: Red Hat security update released