Buffer Over-read Vulnerability in tcpdump: CVE-2018-14470
Summary
ALPINE-CVE-2018-14470: The Babel parser in tcpdump before 4.9.3 has a buffer over-read in print-babel.c:babel_print_v2(). Affects tcpdump versions < 4.9.3-r0. Fixed in 4.9.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tcpdump is a powerful command-line packet analyzer tool used for network diagnostics and monitoring. It allows users to capture and display packets being transmitted or received over a network. The tool is widely utilized by network administrators and security professionals for troubleshooting and analyzing network traffic. However, an identified vulnerability in tcpdump prior to version 4.9.3 can lead to potential security risks, particularly through the Babel parser.
Vulnerability Detail
The vulnerability, identified as CVE-2018-14470, originates from a buffer over-read in the Babel parser within tcpdump versions before 4.9.3. This flaw occurs in the function babel_print_v2() located in print-babel.c. An attacker could exploit this vulnerability to read sensitive data from memory, potentially leading to information leakage. The CVSS score for this vulnerability is 7.5, indicating a high severity level, which necessitates immediate attention from users of affected versions.
How To Fix
Minimum fixed version
4.9.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade tcpdumpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider limiting the use of tcpdump or avoiding the parsing of Babel packets until the package is updated. However, this is not a comprehensive solution and updating is strongly recommended.
Conclusion
The buffer over-read vulnerability in tcpdump, identified as CVE-2018-14470, poses significant risks to users of the affected versions. It is crucial to update to version 4.9.3 or later to mitigate these risks. Users are also encouraged to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their software.
See every vulnerability recorded for tcpdump →
FAQ
CVE-2018-14470 is a vulnerability in tcpdump that allows for a buffer over-read, potentially leading to information leakage.
You can check your version of tcpdump by running 'tcpdump -v' in your terminal. If it is below 4.9.3, it is affected.
The primary risk is the possibility of sensitive data being exposed through memory leaks, which could be exploited by attackers.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can update tcpdump by running 'apk add tcpdump@4.9.3-r0' in your terminal, ensuring you have access to the appropriate repositories.
References
Related vulnerabilities
Recent vulnerabilities recorded for tcpdump.
