Critical Buffer Overflow Vulnerability in tcpdump: CVE-2017-5204
Summary
ALPINE-CVE-2017-5204: The IPv6 parser in tcpdump before 4.9.0 has a buffer overflow in print-ip6.c:ip6_print(). Affects tcpdump versions < 4.9.0-r0. Fixed in 4.9.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tcpdump is a widely used command-line packet analyzer tool that allows users to capture and display network packets being transmitted or received over a network. It is essential for network troubleshooting, analysis, and security auditing. However, tcpdump versions prior to 4.9.0 are vulnerable to a buffer overflow in the IPv6 parser, which can lead to severe security implications.
Vulnerability Detail
The vulnerability, identified as CVE-2017-5204, originates from a buffer overflow in the IPv6 parser located in print-ip6.c:ip6_print() within tcpdump. This flaw allows an attacker to exploit the vulnerability by crafting malicious IPv6 packets, potentially leading to arbitrary code execution, data corruption, or denial of service. The CVSS score for this vulnerability is 9.8, indicating a critical severity level.
How To Fix
Minimum fixed version
4.9.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade tcpdumpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted IPv6 packets until the package is updated. This can be done by filtering incoming packets or using firewall rules to block suspicious traffic.
Conclusion
CVE-2017-5204 represents a significant security risk for users of tcpdump versions prior to 4.9.0 due to a buffer overflow vulnerability in the IPv6 parser. Users are strongly advised to update to the patched version to mitigate potential threats.
See every vulnerability recorded for tcpdump →
FAQ
CVE-2017-5204 is a critical buffer overflow vulnerability in tcpdump that affects versions prior to 4.9.0, allowing potential arbitrary code execution.
You can check your tcpdump version by running 'tcpdump -v' in the command line. If it is below 4.9.0, it is vulnerable.
Failure to address this vulnerability may expose your system to remote code execution, data loss, or denial of service attacks.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for tcpdump.
