Denial of Service Vulnerability in libpcap: NULL Pointer Dereference Risk
Summary
ALPINE-CVE-2019-15163: rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service (NULL pointer dereference and daemon crash) if a crypt() call fails. Affects libpcap versions < 1.1.1-r0. Fixed in 1.1.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libpcap is a widely-used library for network packet capture, allowing applications to capture and analyze network traffic. It provides a high-level interface for packet capture and filtering, making it essential for network monitoring and analysis tools. However, prior to version 1.9.1, libpcap contained a vulnerability that could lead to a denial of service, specifically when the crypt() function call fails, resulting in a NULL pointer dereference.
Vulnerability Detail
The vulnerability identified as ALPINE-CVE-2019-15163 exists in the rpcapd/daemon.c file of libpcap versions before 1.9.1. It allows attackers to exploit a failure in the crypt() function call, leading to a NULL pointer dereference and subsequent crash of the daemon. This can disrupt network monitoring services and potentially expose systems to further attacks, as the service becomes unavailable. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.1.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade libpcapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the rpcapd service if it is not essential for your operations. This can be done by stopping the service using the command: 'service rpcapd stop'. However, this is not a permanent solution and updating the package is strongly advised.
Conclusion
The vulnerability in libpcap prior to version 1.9.1 poses a significant risk of denial of service due to a NULL pointer dereference. It is crucial to update to the patched version to safeguard your systems. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for libpcap →
FAQ
The vulnerability can lead to a denial of service, causing the libpcap daemon to crash and become unavailable, disrupting network monitoring services.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can temporarily stop the rpcapd service as a workaround, but it is not a permanent solution. Updating the package is the recommended approach.
Detailed information can be found in the CVE report for ALPINE-CVE-2019-15163, which outlines the specifics of the vulnerability and its impact.
References
Related vulnerabilities
Recent vulnerabilities recorded for libpcap.
