Critical Buffer Overflow Vulnerability in tcpdump - CVE-2017-5485
Summary
ALPINE-CVE-2017-5485: The ISO CLNS parser in tcpdump before 4.9.0 has a buffer overflow in addrtoname.c:lookup_nsap(). Affects tcpdump versions < 4.9.0-r0. Fixed in 4.9.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tcpdump is a widely used command-line packet analyzer tool that allows users to capture and analyze network traffic. It is essential for network diagnostics and security analysis. The tool supports various protocols and provides detailed insights into network packets. However, tcpdump versions prior to 4.9.0 are vulnerable to a buffer overflow issue that can lead to severe security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2017-5485, originates from a flaw in the ISO CLNS parser within tcpdump. Specifically, the buffer overflow occurs in the addrtoname.c file at the lookup_nsap() function. This flaw can be exploited by attackers to execute arbitrary code, potentially compromising the integrity and confidentiality of the system. The CVSS score for this vulnerability is 9.8, indicating a critical severity level.
How To Fix
Minimum fixed version
4.9.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade tcpdumpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted network traffic or disable the specific features that utilize the vulnerable parser until the package is updated.
Conclusion
CVE-2017-5485 represents a significant security risk for users of tcpdump versions prior to 4.9.0. It is crucial to update to the patched version to mitigate potential threats. Users should also consider using tools like Vulert to monitor their applications for vulnerabilities.
See every vulnerability recorded for tcpdump →
FAQ
CVE-2017-5485 is a critical buffer overflow vulnerability found in tcpdump versions prior to 4.9.0.
You can check your tcpdump version by running 'tcpdump -v' in the terminal. If it is below 4.9.0, it is vulnerable.
Exploitation of this vulnerability can lead to arbitrary code execution, potentially allowing attackers to gain control over the affected system.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just a manifest file like package-lock.json.
Detailed information about CVE-2017-5485 can be found on various security advisory websites and the official tcpdump documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for tcpdump.
