CVE-2018-10103
📋 TL;DR
This vulnerability in tcpdump allows remote attackers to execute arbitrary code or cause denial of service via specially crafted SMB packets. It affects systems running vulnerable versions of tcpdump that process SMB network traffic.
💻 Affected Systems
- tcpdump
📦 What is this software?
Tcpdump by Tcpdump
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with root privileges leading to complete system compromise.
Likely Case
Denial of service through tcpdump crash when processing malicious SMB traffic.
If Mitigated
Limited impact if tcpdump runs with reduced privileges or network exposure is restricted.
🎯 Exploit Status
Exploitation requires sending malicious SMB packets to a network interface being monitored by tcpdump.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.9.3 and later
Vendor Advisory: https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
Restart Required: No
Instructions:
1. Update tcpdump using your package manager: 'sudo apt update && sudo apt upgrade tcpdump' (Debian/Ubuntu) or 'sudo yum update tcpdump' (RHEL/CentOS). 2. Verify installation with 'tcpdump --version'.
🔧 Temporary Workarounds
Disable SMB protocol parsing
allPrevent tcpdump from processing SMB traffic using BPF filters
tcpdump not port 445 and not port 139
Run tcpdump with reduced privileges
linuxExecute tcpdump as non-root user to limit impact
sudo -u nobody tcpdump [options]
🧯 If You Can't Patch
- Restrict tcpdump to trusted network segments only
- Implement network segmentation to isolate SMB traffic from monitoring systems
🔍 How to Verify
Check if Vulnerable:
Run 'tcpdump --version' and check if version is below 4.9.3Check Version:
tcpdump --version | head -1Verify Fix Applied:
Confirm version is 4.9.3 or higher with 'tcpdump --version | head -1'📡 Detection & Monitoring
Log Indicators:
- tcpdump segmentation faults or abnormal termination
- Core dumps from tcpdump process
Network Indicators:
- Unusual SMB traffic patterns to monitoring interfaces
- Malformed SMB packets
SIEM Query:
process_name:"tcpdump" AND (event_type:"crash" OR exit_code:139)🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html
- http://seclists.org/fulldisclosure/2019/Dec/26
- https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
- https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/
- https://seclists.org/bugtraq/2019/Dec/23
- https://seclists.org/bugtraq/2019/Oct/28
- https://security.netapp.com/advisory/ntap-20200120-0001/
- https://support.apple.com/kb/HT210788
- https://support.f5.com/csp/article/K44551633?utm_source=f5support&%3Butm_medium=RSS
- https://usn.ubuntu.com/4252-1/
- https://usn.ubuntu.com/4252-2/
- https://www.debian.org/security/2019/dsa-4547
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html
- http://seclists.org/fulldisclosure/2019/Dec/26
- https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
- https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/
- https://seclists.org/bugtraq/2019/Dec/23
- https://seclists.org/bugtraq/2019/Oct/28
- https://security.netapp.com/advisory/ntap-20200120-0001/
- https://support.apple.com/kb/HT210788
- https://support.f5.com/csp/article/K44551633?utm_source=f5support&%3Butm_medium=RSS
- https://usn.ubuntu.com/4252-1/
- https://usn.ubuntu.com/4252-2/
- https://www.debian.org/security/2019/dsa-4547
