Buffer Over-read Vulnerability in tcpdump: CVE-2018-14463
Summary
ALPINE-CVE-2018-14463: The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 2, a different vulnerability than CVE-2019-15167. Affects tcpdump versions < 4.9.3-r0. Fixed in 4.9.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tcpdump is a powerful command-line packet analyzer tool used for network traffic monitoring and analysis. It allows users to capture and display the packets being transmitted or received over a network to which the computer is attached. The tool is widely used by network administrators and security professionals for troubleshooting and analyzing network issues. However, tcpdump versions prior to 4.9.3 are vulnerable to a buffer over-read issue in the VRRP parser, specifically in the function print-vrrp.c:vrrp_print(). This vulnerability can lead to potential information leaks and may affect the integrity of network data.
Vulnerability Detail
The vulnerability, identified as CVE-2018-14463, arises from a buffer over-read in the VRRP parser of tcpdump before version 4.9.3. This issue specifically affects the handling of VRRP version 2 packets. An attacker could exploit this vulnerability to read beyond the allocated buffer, potentially exposing sensitive information or causing unexpected behavior in the application. The CVSS score for this vulnerability is 7.5, indicating a high severity level, which necessitates prompt attention and remediation.
How To Fix
Minimum fixed version
4.9.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade tcpdumpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the tcpdump tool or using alternative network monitoring tools until the vulnerability can be addressed. Additionally, ensure that your network is monitored for unusual traffic patterns that may indicate exploitation attempts.
Conclusion
The buffer over-read vulnerability in tcpdump (CVE-2018-14463) poses a significant risk to network security. Users are strongly advised to update to version 4.9.3 or later to mitigate this risk. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for tcpdump →
FAQ
CVE-2018-14463 is a buffer over-read vulnerability in tcpdump that affects the VRRP parser, potentially leading to information leaks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
Exploitation of this vulnerability could lead to unauthorized access to sensitive information or unexpected behavior in network monitoring.
Yes, tcpdump version 4.9.3 and later includes a patch that resolves this vulnerability.
Consider restricting access to tcpdump and monitoring network traffic for unusual patterns until you can apply the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for tcpdump.
