CVE-2018-16301
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the value of the -F command-line argument of tcpdump.
Risk Assessment
An attacker with local access can cause a buffer overflow, potentially leading to a crash or arbitrary code execution in the context of tcpdump.
Recommendation
Update tcpdump to version 4.99.0 or later.
Other vulnerabilities in tcpdump
See all- CVE-2015-3138High
The print-wb.c file in tcpdump before version 4.7.4 contains a vulnerability that allows remote attackers to cause a denial of service through a segmentation fault and process crash.
- CVE-2017-12989High
The RESP parser in tcpdump before version 4.9.2 could enter an infinite loop due to a bug in print-resp.c:resp_get_length().
- CVE-2017-11108High
tcpdump version 4.9.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via crafted packet data. The crash occurs in the EXTRACT_16BITS function, called from the stp_print function for the Spanning Tree Protocol.
- CVE-2015-2155High
A vulnerability in tcpdump before version 4.7.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
- CVE-2015-0261High
Integer signedness error in the mobility_opt_print function in the IPv6 mobility printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) or possibly execute arbitrary code via a negative length value.
- CVE-2017-13725Critical
The IPv6 routing header parser in tcpdump before version 4.9.2 has a buffer over-read in the rt6_print() function.
- CVE-2017-13690Critical
The IKEv2 parser in tcpdump before version 4.9.2 has a buffer over-read in print-isakmp.c in several functions.
- CVE-2017-13689Critical
The IKEv1 parser in tcpdump before version 4.9.2 has a buffer over-read in the ikev1_id_print() function.
- CVE-2017-13688Critical
The OLSR parser in tcpdump before version 4.9.2 has a buffer over-read in the olsr_print() function.
- CVE-2017-13687Critical
The HDLC parser in tcpdump before version 4.9.2 has a buffer over-read in the chdlc_print() function.
Original NVD description (English source)
The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the value of the -F command-line argument of tcpdump.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS