PT-2017-12834 · Tcpdump+4 · Tcpdump+4
Antti Levomäki
+1
·
Publicado
2017-09-10
·
Atualizado
2024-06-15
·
CVE-2017-12995
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
tcpdump versions prior to 4.9.2
Description
The issue is related to the DNS parser in tcpdump, which could enter an infinite loop due to a bug in the
ns print() function. This is caused by a flaw in the print-domain.c file. Additionally, there is a buffer overread memory issue in the HNCP component that could allow a remote attacker to obtain sensitive information by sending a specially crafted request.Recommendations
For versions prior to 4.9.2, update to version 4.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the HNCP component to minimize the risk of exploitation.
Correção
Out of bounds Read
Infinite Loop
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Ibm Aix
Suse
Ubuntu
Tcpdump