PT-2017-3918 · Tcpdump+7 · Tcpdump+7

Bhargava Shastry · Published 2017-10-08 · Updated 2025-12-03 · CVE-2018-14467

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions tcpdump versions prior to 4.9.3

Description The issue is related to a buffer over-read in the BGP parser of the tcpdump utility, specifically in the bgp capabilities print() function. This can be exploited by a remote attacker to cause a denial of service or potentially gain unauthorized access to information, affecting its integrity and availability.

Recommendations For versions prior to 4.9.3, update to version 4.9.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the bgp capabilities print() function until a patch is available.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2019-3120

ALT-PU-2020-3563

ALT-PU-2021-1433

BDU:2019-04771

BDU:2020-04981

CESA-2020_4760

CVE-2018-14467

DLA-1955-1

DSA-4547-1

MGASA-2019-0297

OPENSUSE-SU-2019:2344-1

OPENSUSE-SU-2019:2348-1

OPENSUSE-SU-2019_2344-1

OPENSUSE-SU-2019_2348-1

OPENSUSE-SU-2024:11425-1

RHSA-2020:4760

RHSA-2020_4760

RLSA-2020:4760

SUSE-SU-2019:14191-1

SUSE-SU-2019:2674-1

SUSE-SU-2019_14191-1

SUSE-SU-2020:3360-1

USN-4252-1

USN-4252-2

Affected Products

Alt Linux

Centos

Ibm Aix

Red Hat

Rocky Linux

Suse

Ubuntu

Tcpdump

References · 280

• https://github.com/the-tcpdump-group/tcpdump/commit/e3f3b445e2d20ac5d5b7fcb7559ce6beb55da0c9 · Patch
• https://usn.ubuntu.com/4252-1 · Vendor Advisory
• https://usn.ubuntu.com/4252-2 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2020:4760 · Vendor Advisory
• https://debian.org/security/2019/dsa-4547 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16227 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-14467 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14463 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2018-14467 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16229 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15167 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4547-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10105 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2348-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1955-1 · Vendor Advisory