Authentication Information Disclosure in libpcap - CVE-2019-15162
Summary
ALPINE-CVE-2019-15162: rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which might make it easier for attackers to enumerate valid usernames. Affects libpcap versions < 1.1.1-r0. Fixed in 1.1.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libpcap is a widely used library for network packet capture and analysis. It provides a portable framework for low-level network monitoring and is essential for various network analysis tools. The library is utilized in both Unix-like and Windows operating systems, allowing developers to capture network traffic in a standardized manner. However, prior to version 1.9.1, libpcap contained a vulnerability that could expose sensitive authentication details.
Vulnerability Detail
The vulnerability identified as CVE-2019-15162 exists in the rpcapd daemon of libpcap before version 1.9.1 on non-Windows platforms. It allows the daemon to disclose information regarding failed authentication attempts, potentially enabling attackers to enumerate valid usernames. This could lead to unauthorized access or further exploitation of the system. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.1.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade libpcapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable the rpcapd service if it is not required for their operations. This can be done by stopping the service with the command: 'service rpcapd stop'. However, this is not a permanent solution and updating the package is strongly advised.
Conclusion
CVE-2019-15162 represents a significant security concern for users of the libpcap library prior to version 1.9.1. By updating to the latest version and following recommended practices, users can protect their systems from potential exploitation. Utilizing tools like Vulert can further enhance security by providing real-time alerts for open-source vulnerabilities.
See every vulnerability recorded for libpcap →
FAQ
CVE-2019-15162 is a vulnerability in the libpcap library that allows unauthorized disclosure of authentication failure details, potentially aiding attackers in username enumeration.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2019-15162 is 5.3, indicating a moderate level of severity.
If exploited, this vulnerability could allow attackers to enumerate valid usernames, leading to unauthorized access and potential further exploitation of the system.
Yes, the vulnerability has been patched in libpcap version 1.9.1-r0 and later. Users should update to this version to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for libpcap.
