PT-2017-12829 · Tcpdump+4 · Tcpdump+4
Antti Levomäki
+1
·
Publicado
2017-09-10
·
Atualizado
2024-06-15
·
CVE-2017-12990
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
tcpdump versions prior to 4.9.2
Description
The issue is related to the ISAKMP parser in tcpdump, which could enter an infinite loop due to bugs in print-isakmp.c, affecting several functions. Additionally, it could allow a remote attacker to obtain sensitive information by exploiting a buffer overread memory in the HNCP component. This can be achieved by sending a specially crafted request.
Recommendations
For versions prior to 4.9.2, update to version 4.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the HNCP component to minimize the risk of exploitation.
Correção
Out of bounds Read
Infinite Loop
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Ibm Aix
Suse
Ubuntu
Tcpdump