Buffer Over-read Vulnerability in tcpdump
Summary
CVE-2018-14468: The FRF.16 parser in tcpdump before 4.9.3 has a buffer over-read in print-fr.c:mfr_print(). Affects tcpdump across 2 version ranges.
< 4.9.3-r0
< aa3e54f594385ce7e1e319b0c84999e51192578b
Fixed in 4.9.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tcpdump is a widely used network packet analyzer tool that allows users to capture and analyze network traffic. It is commonly used for troubleshooting network issues, monitoring network activity, and performing network security analysis. However, tcpdump versions prior to 4.9.3 are affected by a buffer over-read vulnerability in the FRF.16 parser, specifically in the mfr_print() function in print-fr.c.
Vulnerability Detail
The buffer over-read vulnerability in tcpdump's FRF.16 parser can be exploited by an attacker to read beyond the boundaries of a buffer, potentially leading to the disclosure of sensitive information or a denial of service. This vulnerability exists due to improper input validation when parsing FRF.16 packets. An attacker could craft a malicious packet and send it to a vulnerable tcpdump instance, triggering the buffer over-read and potentially causing the application to crash or revealing sensitive data.
How To Fix
Minimum fixed version
4.9.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade tcpdumpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to update tcpdump to the latest version as soon as possible.
Conclusion
The buffer over-read vulnerability in tcpdump's FRF.16 parser can have serious security implications, potentially leading to the disclosure of sensitive information or a denial of service. It is crucial to update tcpdump to version 4.9.3 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tcpdump →
FAQ
tcpdump is a network packet analyzer tool used for capturing and analyzing network traffic.
This vulnerability could potentially allow an attacker to read sensitive information or cause a denial of service.
You can use the Vulert playground at Vulert Scanner to check if your tcpdump version is affected by this vulnerability.
Yes, the vulnerability can be fixed by updating tcpdump to version 4.9.3 or later.
No, there are no known workarounds for this vulnerability. Updating tcpdump is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for tcpdump.
