Executive brief
Tcpdump, a widely used tool for monitoring and analyzing network traffic, contains a vulnerability in its ISO CLNS protocol parser. An attacker can exploit this by sending specially crafted network packets to a system running tcpdump, potentially causing the application to crash or allowing for unauthorized code execution. This could lead to a complete system compromise or a disruption of network monitoring capabilities.
Technical details
A buffer overflow vulnerability exists in tcpdump versions prior to 4.9.0 within the ISO Connectionless Network Service (CLNS) parser, specifically in the clnp_print() function located in print-isoclns.c. The flaw is triggered when the utility processes malformed packets, either during live capture or when reading a crafted pcap file. Because tcpdump often runs with elevated privileges to capture raw network traffic, a successful exploit could allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service (DoS) condition via a crash. The vulnerability is addressed in version 4.9.0.
Affected products
- tcpdump tcpdump < 4.9.0
Timeline
- 2017-01-26: disclosed: Initial report in Debian bug tracking system
- 2017-01-28: advisory: NVD publication date
- 2017-01-29: patched: Debian security update released