tcpdump 'pimv1_print()' Function Buffer Overflow Vulnerability
BID:99940
Info
tcpdump 'pimv1_print()' Function Buffer Overflow Vulnerability
| Bugtraq ID: | 99940 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2017-11542 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 22 2017 12:00AM |
| Updated: | Jul 22 2017 12:00AM |
| Credit: | hackerlib |
| Vulnerable: |
tcpdump tcpdump 4.9 |
| Not Vulnerable: | |
Discussion
tcpdump 'pimv1_print()' Function Buffer Overflow Vulnerability
tcpdump is prone to a buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.
An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will likely cause a denial-of-service condition.
tcpdump 4.9.0 is vulnerable; other versions may also be vulnerable.
tcpdump is prone to a buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.
An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will likely cause a denial-of-service condition.
tcpdump 4.9.0 is vulnerable; other versions may also be vulnerable.
Exploit / POC
tcpdump 'pimv1_print()' Function Buffer Overflow Vulnerability
The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.
The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.
Solution / Fix
tcpdump 'pimv1_print()' Function Buffer Overflow Vulnerability
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].