PT-2017-11745 · Tcpdump+2 · Tcpdump+2

Owl337 · Published 2017-07-08 · Updated 2024-06-15 · CVE-2017-11108

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions tcpdump version 4.9.0

Description The issue allows remote attackers to cause a denial of service, resulting in a heap-based buffer over-read and application crash, via crafted packet data. This occurs in the EXTRACT 16BITS function, which is called from the stp print function for the Spanning Tree Protocol.

Recommendations For tcpdump version 4.9.0, consider updating to a newer version that contains a fix for this issue, as the current version is affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2017-11108

DLA-1090-1

DSA-3971-1

MGASA-2017-0241

OPENSUSE-SU-2024:11425-1

SUSE-SU-2017:2690-1

SUSE-SU-2017:2854-1

SUSE-SU-2017_2690-1

SUSE-SU-2017_2854-1

USN-3415-1

USN-3415-2

Affected Products

Suse

Ubuntu

Tcpdump

References · 468

• https://ubuntu.com/security/CVE-2017-12899 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12998 · Security Note
• https://ubuntu.com/security/CVE-2017-13054 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13015 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12896 · Security Note
• https://ubuntu.com/security/CVE-2017-13005 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-13687 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13029 · Security Note
• https://ubuntu.com/security/CVE-2017-13025 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12997 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13037 · Security Note
• https://ubuntu.com/security/CVE-2017-13015 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13047 · Security Note
• https://ubuntu.com/security/CVE-2017-13012 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-13016 · Vendor Advisory