Buffer Over-read Vulnerability in tcpdump: CVE-2018-14468
Summary
ALPINE-CVE-2018-14468: The FRF.16 parser in tcpdump before 4.9.3 has a buffer over-read in print-fr.c:mfr_print(). Affects tcpdump versions < 4.9.3-r0. Fixed in 4.9.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
tcpdump is a powerful command-line packet analyzer tool used for network traffic analysis. It allows users to capture and display packets being transmitted or received over a network. The tool is widely utilized for network troubleshooting, security analysis, and protocol development. However, tcpdump versions prior to 4.9.3 are susceptible to a buffer over-read vulnerability, which can lead to potential information disclosure and instability.
Vulnerability Detail
The vulnerability identified as CVE-2018-14468 originates from the FRF.16 parser in tcpdump versions before 4.9.3. It features a buffer over-read in the function print-fr.c:mfr_print(). This flaw can allow an attacker to exploit the vulnerability, potentially leading to unauthorized access to sensitive information or causing the application to behave unpredictably. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
4.9.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade tcpdumpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the FRF.16 parser or limit the use of tcpdump to environments where the risk of exploitation is minimized. However, the best course of action is to update to the patched version.
Conclusion
In summary, the buffer over-read vulnerability in tcpdump (CVE-2018-14468) poses significant risks to users of affected versions. It is crucial to update to version 4.9.3 or later to mitigate these risks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for tcpdump →
FAQ
CVE-2018-14468 is a buffer over-read vulnerability found in tcpdump versions before 4.9.3, which can lead to information disclosure.
You can check your version of tcpdump by running 'tcpdump -v' in your terminal. If it is below 4.9.3, it is vulnerable.
The risks include potential information disclosure and application instability, which can be exploited by attackers.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for tcpdump.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
