Integer Overflow in TCPFLOW Allows Out-of-Bounds Read and Denial of Service (CVE-2018-14938)
Summary
CVE-2018-14938: An issue was discovered in wifipcap/wifipcap.cpp in TCPFLOW through 1.5.0-alpha. Affects tcpflow across 2 version ranges.
< 1.5.0-r0
< a4e1cd14eb5ccc51ed271b65b3420f7d692c40eb
Fixed in 1.5.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TCPFLOW is a tool for capturing and analyzing network traffic. It allows users to intercept and log network packets passing through a network interface. This vulnerability affects TCPFLOW versions prior to 1.5.0-alpha. The issue resides in the wifipcap/wifipcap.cpp file and involves an integer overflow in the handle_prism function during caplen processing. If the caplen is less than 144, it can trigger an integer overflow in the handle_80211 function, leading to an out-of-bounds read and potential access to sensitive memory or a denial of service.
Vulnerability Detail
The integer overflow vulnerability in TCPFLOW can be exploited by an attacker to read sensitive memory or cause a denial of service. By manipulating the caplen value to be less than 144, the handle_80211 function can be triggered to perform an out-of-bounds read. This can potentially expose sensitive information or crash the application, leading to a denial of service. The vulnerability has a CVSS score of 9.1, indicating a critical severity level.
How To Fix
Minimum fixed version
1.5.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade tcpflowTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The integer overflow vulnerability in TCPFLOW can lead to an out-of-bounds read and potential access to sensitive memory or a denial of service. It is crucial to update TCPFLOW to version 1.5.0-alpha or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tcpflow →
FAQ
TCPFLOW is a network traffic capture and analysis tool.
The vulnerability can allow an attacker to read sensitive memory or cause a denial of service.
The CVSS score of this vulnerability is 9.1, indicating a critical severity level.
To fix this vulnerability, update TCPFLOW to version 1.5.0-alpha or later.
No workaround has been provided for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for tcpflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
