Buffer Over-read Vulnerability in TCPFLOW Package
Summary
ALPINE-CVE-2018-18409: A stack-based buffer over-read exists in setbit() at iptree.h of TCPFLOW 1.5.0, due to received incorrect values causing incorrect computation, leading to denial of service during an address_histogram call or a get_histo... Affects tcpflow versions < 1.5.0-r1. Fixed in 1.5.0-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TCPFLOW is a powerful tool used for capturing and analyzing TCP traffic. It allows users to reconstruct and display the data streams of TCP connections, making it invaluable for network analysis and debugging. However, the package has been found to have a critical vulnerability that can lead to denial of service under certain conditions.
Vulnerability Detail
A stack-based buffer over-read exists in the setbit() function located in iptree.h of TCPFLOW version 1.5.0. This vulnerability arises from the processing of incorrect values, which can lead to erroneous computations. The consequences of this vulnerability include potential denial of service during operations such as address_histogram or get_histogram calls, which can disrupt normal functionality and availability of the service.
How To Fix
Minimum fixed version
1.5.0-r1
This is the first release that contains the fix.
sudo apk add --upgrade tcpflowTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if upgrading is not immediately possible, you can limit access to the TCPFLOW service or implement network-level controls to mitigate exposure to the vulnerability until a patch can be applied.
Conclusion
The TCPFLOW package has a critical vulnerability that can lead to denial of service due to a stack-based buffer over-read. Users are advised to update to the patched version 1.5.0-r1 to mitigate this risk. Monitoring tools like Vulert can assist in identifying and managing such vulnerabilities effectively.
See every vulnerability recorded for tcpflow →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary impact of this vulnerability is denial of service, which can disrupt the normal operation of applications relying on TCPFLOW.
Yes, Vulert provides a service that monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If an immediate update is not feasible, consider implementing network-level restrictions to limit access to the service until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for tcpflow.
