PT-2019-5660 · Tcpdump+4 · Tcpdump+4
Published
2019-07-22
·
Updated
2024-06-15
·
CVE-2019-1010220
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
tcpdump version 4.9.2
Description
The issue is caused by a buffer over-read, which may expose sensitive information such as the Saved Frame Pointer and Return Address on the stack. This occurs in the
print prefix function, specifically at line 234 in the "print-hncp.c" component, where the code ND PRINT((ndo, "%s", buf)) is executed. The attack vector involves the victim opening a specially crafted pcap file, allowing a potential attacker to disclose protected information.Recommendations
For tcpdump version 4.9.2, consider avoiding the use of the
print prefix function in "print-hncp.c" until a patch is available. As a temporary workaround, restrict the opening of pcap files from untrusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Buffer Over-read
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Debian
Suse
Ubuntu
Tcpdump