Denial of Service Vulnerability in tcpdump: Heap-based Buffer Over-read
Summary
ALPINE-CVE-2017-11108: tcpdump 4.9.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via crafted packet data. Affects tcpdump versions < 4.9.1-r0. Fixed in 4.9.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tcpdump is a powerful command-line packet analyzer tool widely used for network traffic analysis. It allows users to capture and display packets being transmitted or received over a network. The tool is essential for network troubleshooting, security analysis, and protocol development. However, a vulnerability has been identified in tcpdump versions prior to 4.9.1-r0, which can lead to severe security implications.
Vulnerability Detail
The vulnerability in tcpdump, identified as CVE-2017-11108, allows remote attackers to exploit crafted packet data, leading to a denial of service. This is caused by a heap-based buffer over-read in the EXTRACT_16BITS function, which is invoked by the stp_print function for the Spanning Tree Protocol. If exploited, this vulnerability can cause the application to crash, disrupting network monitoring and analysis activities.
How To Fix
Minimum fixed version
4.9.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade tcpdumpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted or malformed packet data that may trigger the vulnerability. Additionally, running tcpdump with limited privileges can help mitigate potential risks until the package is updated.
Conclusion
The tcpdump vulnerability CVE-2017-11108 poses a significant risk of denial of service due to a heap-based buffer over-read. It is essential for users to update to the patched version 4.9.1-r0 to protect against potential exploitation. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for tcpdump →
FAQ
CVE-2017-11108 is a vulnerability in tcpdump that allows remote attackers to cause a denial of service through crafted packet data.
All versions of tcpdump prior to 4.9.1-r0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to application crashes, disrupting network monitoring and analysis, which can have serious implications for network security.
Yes, you can avoid processing untrusted packet data and run tcpdump with limited privileges to mitigate risks until the patch is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for tcpdump.
