Quick answers
- Is CVE-2017-5486 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2017-5486 being exploited in the wild.
- How severe is CVE-2017-5486?
- Critical severity, with a CVSS score of 9.8, published 28 January 2017.
- Which products and versions are affected?
- tcpdump tcpdump < 4.9.0.
- Is there a fix for CVE-2017-5486?
- A patch was published on 2017-01-29: Debian security update released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2017-5486 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2017-5486?
- Check whether you run Tcpdump. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A buffer overflow vulnerability exists in tcpdump versions prior to 4.9.0 within the ISO Connectionless Network Service (CLNS) parser, specifically in the clnp_print() function located in print-isoclns.c. The flaw is triggered when the utility processes malformed packets, either during live capture or when reading a crafted pcap file. Because tcpdump often runs with elevated privileges to capture raw network traffic, a successful exploit could allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service (DoS) condition via a crash. The vulnerability is addressed in version 4.9.0.
Affected products
- tcpdump tcpdump < 4.9.0
Timeline
- 2017-01-26: disclosed: Initial report in Debian bug tracking system
- 2017-01-28: advisory: NVD publication date
- 2017-01-29: patched: Debian security update released