PT-2015-5633 · Tcpdump+5 · Tcpdump+5

Luke Arntson · Published 2015-03-17 · Updated 2024-06-15 · CVE-2015-2153

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions tcpdump versions prior to 4.7.2

Description The issue allows remote attackers to cause a denial of service, resulting in an out-of-bounds read or write and crash, via a crafted header length in an RPKI-RTR Protocol Data Unit (PDU). This is due to a problem in the rpki rtr pdu print function.

Recommendations For versions prior to 4.7.2, update to version 4.7.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the rpki rtr pdu print function until a patch is available.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2019-1321

CESA-2017_1871

CVE-2015-2153

DSA-3193-1

ELSA-2017-1871

MGASA-2015-0114

OPENSUSE-SU-2024:10396-1

RHSA-2017:1871

RHSA-2017_1871

SUSE-SU-2015:0679-1

SUSE-SU-2015_0679-1

SUSE-SU-2017:1110-1

SUSE-SU-2017_1110-1

USN-2580-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Tcpdump

References · 352

• 🔥 https://github.com/arntsonl/CVE-2015-2153 · Exploit
• 🔥 https://exploit-db.com/exploits/37663 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13049 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13038 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13023 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13011 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7926 · Security Note
• https://security-tracker.debian.org/tracker/source-package/tcpdump · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13055 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7938 · Security Note
• https://debian.org/security/2015/dsa-3193 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-2153 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13004 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7975 · Security Note
• https://osv.dev/vulnerability/CVE-2015-2153 · Vendor Advisory