Critical Vulnerability in tcpdump: SMB Data Handling Flaw
Summary
ALPINE-CVE-2018-10105: tcpdump before 4.9.3 mishandles the printing of SMB data (issue 2 of 2). Affects tcpdump versions < 4.9.3-r0. Fixed in 4.9.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tcpdump is a powerful command-line packet analyzer tool used for network troubleshooting and analysis. It allows users to capture and display the packets being transmitted or received over a network to which the computer is attached. The tool is widely used by network administrators and security professionals to monitor network traffic and diagnose issues. However, prior to version 4.9.3, tcpdump had a vulnerability that mishandled the printing of SMB (Server Message Block) data, which could lead to information disclosure.
Vulnerability Detail
The vulnerability identified as CVE-2018-10105 affects tcpdump versions before 4.9.3. It arises from improper handling of SMB data during packet capture, which could allow an attacker to exploit this flaw to disclose sensitive information. This vulnerability is particularly concerning as it has a CVSS score of 9.8, indicating a critical severity level. Attackers could potentially use this flaw to gain unauthorized access to sensitive data transmitted over the network, leading to significant security risks.
How To Fix
Minimum fixed version
4.9.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade tcpdumpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using tcpdump to capture SMB traffic until they can update to the patched version. This will help mitigate the risk of exposing sensitive information during packet analysis.
Conclusion
In summary, tcpdump versions prior to 4.9.3 contain a critical vulnerability (CVE-2018-10105) that mishandles SMB data, posing significant security risks. It is crucial to update to the patched version to protect against potential data breaches. Utilizing tools like Vulert can further enhance your security posture by monitoring for open-source vulnerabilities.
See every vulnerability recorded for tcpdump →
FAQ
CVE-2018-10105 is a vulnerability in tcpdump that affects versions prior to 4.9.3, where SMB data is mishandled, potentially leading to information disclosure.
You can check your version of tcpdump by running 'tcpdump -v' in your terminal. If it is below 4.9.3, it is vulnerable.
Failing to fix this vulnerability could allow attackers to capture sensitive SMB data, leading to unauthorized access and potential data breaches.
Yes, Vulert can monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for tcpdump.
