Buffer Over-read Vulnerability in tcpdump: CVE-2018-16230
Summary
ALPINE-CVE-2018-16230: The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI). Affects tcpdump versions < 4.9.3-r0. Fixed in 4.9.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tcpdump is a powerful command-line packet analyzer tool used for network traffic analysis. It allows users to capture and display packets being transmitted or received over a network to troubleshoot issues or monitor network activity. The tool is widely utilized by network administrators and security professionals for its ability to dissect various network protocols. However, a vulnerability identified as CVE-2018-16230 has been discovered in tcpdump versions prior to 4.9.3, which could lead to potential security risks.
Vulnerability Detail
The vulnerability stems from a buffer over-read in the BGP parser of tcpdump, specifically in the function print-bgp.c:bgp_attr_print(). This flaw can be exploited to read beyond the intended buffer, potentially exposing sensitive data or causing unexpected behavior in the application. The issue is particularly concerning as it affects the handling of the MP_REACH_NLRI attribute in BGP packets, which could lead to information disclosure or denial of service. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
4.9.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade tcpdumpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using tcpdump to analyze BGP packets until the package is updated to a secure version. Additionally, monitoring network traffic with alternative tools that do not exhibit this vulnerability may be considered.
Conclusion
The buffer over-read vulnerability in tcpdump, identified as CVE-2018-16230, poses significant risks to network security. Users are strongly advised to update to the patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for tcpdump →
FAQ
CVE-2018-16230 is a vulnerability in tcpdump that allows for a buffer over-read in the BGP parser, potentially leading to information disclosure.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability could lead to sensitive data exposure or denial of service, impacting the integrity and availability of network services.
Yes, tcpdump has released a patch in version 4.9.3, which addresses the buffer over-read issue.
If immediate updating is not possible, refrain from using tcpdump for analyzing BGP packets and consider alternative network analysis tools.
References
Related vulnerabilities
Recent vulnerabilities recorded for tcpdump.
