Red Hat Enhancement Advisory: tcpdump bug fix and enhancement update

Moderate

tcpdump 4.9.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via crafted packet data. The crash occurs in the EXTRACT_16BITS function, called from the stp_print function for the Spanning Tree Protocol.

CWE-122 - Heap-based Buffer Overflow

tcpdump 4.9.0 has a heap-based buffer over-read in the lldp_print function in print-lldp.c, related to util-print.c.

CWE-125 - Out-of-bounds Read

tcpdump 4.9.0 has a heap-based buffer over-read in the pimv1_print function in print-pim.c.

CWE-125 - Out-of-bounds Read

A vulnerability was discovered in tcpdump's handling of LINKTYPE_SLIP pcap files. An attacker could craft a malicious pcap file that would cause tcpdump to crash when attempting to print a summary of packet data within the file.

CWE-787 - Out-of-bounds Write

A vulnerability was discovered in tcpdump's handling of LINKTYPE_SLIP pcap files. An attacker could craft a malicious pcap file that would cause tcpdump to crash when attempting to print a summary of packet data within the file.

CWE-125 - Out-of-bounds Read

The SMB/CIFS parser in tcpdump before 4.9.2 has a buffer over-read in smbutil.c:name_len().

CWE-125 - Out-of-bounds Read

Several protocol parsers in tcpdump before 4.9.2 could cause a buffer over-read in addrtoname.c:lookup_bytestring().

CWE-125 - Out-of-bounds Read

The ICMP parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp.c:icmp_print().

CWE-125 - Out-of-bounds Read

The ISAKMP parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:isakmp_rfc3948_print().

CWE-125 - Out-of-bounds Read

The ISO CLNS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isoclns_print().

CWE-125 - Out-of-bounds Read

The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:interp_reply().

CWE-125 - Out-of-bounds Read

The DECnet parser in tcpdump before 4.9.2 has a buffer over-read in print-decnet.c:decnet_print().

CWE-125 - Out-of-bounds Read

Several protocol parsers in tcpdump before 4.9.2 could cause a buffer over-read in util-print.c:tok2strbuf().

CWE-125 - Out-of-bounds Read

The EIGRP parser in tcpdump before 4.9.2 has a buffer over-read in print-eigrp.c:eigrp_print().

CWE-125 - Out-of-bounds Read