PT-2017-11745 · Tcpdump+2 · Tcpdump+2

Owl337 · Publicado 2017-07-08 · Atualizado 2024-06-15 · CVE-2017-11108

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions tcpdump version 4.9.0

Description The issue allows remote attackers to cause a denial of service, resulting in a heap-based buffer over-read and application crash, via crafted packet data. This occurs in the EXTRACT 16BITS function, which is called from the stp print function for the Spanning Tree Protocol.

Recommendations For tcpdump version 4.9.0, consider updating to a newer version that contains a fix for this issue, as the current version is affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2017-11108

DLA-1090-1

DSA-3971-1

MGASA-2017-0241

OPENSUSE-SU-2024:11425-1

SUSE-SU-2017:2690-1

SUSE-SU-2017:2854-1

SUSE-SU-2017_2690-1

SUSE-SU-2017_2854-1

USN-3415-1

USN-3415-2

Produtos afetados

Suse

Ubuntu

Tcpdump

Referências · 468

• https://github.com/hackerlib/hackerlib-vul/tree/master/tcpdump-vul/heap-buffer-overflow/util-print · Nota
• https://github.com/hackerlib/hackerlib-vul/tree/master/tcpdump-vul/global-overflow/print-sl · Nota
• https://github.com/hackerlib/hackerlib-vul/tree/master/tcpdump-vul/heap-buffer-overflow/print-pim · Nota
• https://suse.com/security/cve/CVE-2017-13012 · Nota
• https://ubuntu.com/security/CVE-2017-12899 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12998 · Nota de Segurança
• https://suse.com/security/cve/CVE-2017-13012.html · Nota
• https://ubuntu.com/security/CVE-2017-13054 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13015 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12896 · Nota de Segurança
• https://suse.com/security/cve/CVE-2017-5202 · Nota
• https://suse.com/security/cve/CVE-2018-14879 · Nota
• https://ubuntu.com/security/CVE-2017-13005 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-13034.html · Nota
• https://suse.com/security/cve/CVE-2017-13050.html · Nota