CVE-2018-14461
📋 TL;DR
This vulnerability in tcpdump's LDP parser allows attackers to trigger a buffer over-read when processing specially crafted LDP packets. Systems running vulnerable versions of tcpdump that process LDP traffic are affected, potentially leading to information disclosure or denial of service.
💻 Affected Systems
- tcpdump
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Leap by Opensuse
Leap by Opensuse
Tcpdump by Tcpdump
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, though this is unlikely given the CWE-125 classification (out-of-bounds read rather than write).
Likely Case
Application crash (denial of service) or information disclosure through memory content leakage.
If Mitigated
Limited impact with proper network segmentation and minimal exposure of tcpdump to untrusted traffic.
🎯 Exploit Status
Exploitation requires sending specially crafted LDP packets to a system where tcpdump is running and processing such traffic. Public proof-of-concept exists in disclosure references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: tcpdump 4.9.3 and later
Vendor Advisory: https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
Restart Required: No
Instructions:
1. Update tcpdump using your distribution's package manager. 2. For source installations: download tcpdump 4.9.3+ from the-tcpdump-group/tcpdump GitHub, compile, and install.
🔧 Temporary Workarounds
Disable LDP parsing
allRun tcpdump with LDP protocol filtering disabled
tcpdump not ldp
Restrict tcpdump usage
linuxLimit tcpdump execution to trusted users and networks
chmod 750 /usr/sbin/tcpdump
setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump
🧯 If You Can't Patch
- Restrict network access to systems running tcpdump, especially from untrusted sources
- Monitor for crashes of tcpdump processes and investigate any anomalies
🔍 How to Verify
Check if Vulnerable:
Run: tcpdump --version | head -1. If version is earlier than 4.9.3, system is vulnerable.Check Version:
tcpdump --version | head -1Verify Fix Applied:
After update, run: tcpdump --version | head -1. Confirm version is 4.9.3 or higher.📡 Detection & Monitoring
Log Indicators:
- tcpdump segmentation fault or crash logs
- unexpected tcpdump process termination
Network Indicators:
- Unusual LDP packet patterns directed at monitoring interfaces
- MPLS/LDP traffic to non-routing systems
SIEM Query:
process_name="tcpdump" AND (event_type="crash" OR exit_code="139")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html
- http://seclists.org/fulldisclosure/2019/Dec/26
- https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
- https://github.com/the-tcpdump-group/tcpdump/commit/aa5c6b710dfd8020d2c908d6b3bd41f1da719b3b
- https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/
- https://seclists.org/bugtraq/2019/Dec/23
- https://seclists.org/bugtraq/2019/Oct/28
- https://security.netapp.com/advisory/ntap-20200120-0001/
- https://support.apple.com/kb/HT210788
- https://usn.ubuntu.com/4252-1/
- https://usn.ubuntu.com/4252-2/
- https://www.debian.org/security/2019/dsa-4547
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html
- http://seclists.org/fulldisclosure/2019/Dec/26
- https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
- https://github.com/the-tcpdump-group/tcpdump/commit/aa5c6b710dfd8020d2c908d6b3bd41f1da719b3b
- https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/
- https://seclists.org/bugtraq/2019/Dec/23
- https://seclists.org/bugtraq/2019/Oct/28
- https://security.netapp.com/advisory/ntap-20200120-0001/
- https://support.apple.com/kb/HT210788
- https://usn.ubuntu.com/4252-1/
- https://usn.ubuntu.com/4252-2/
- https://www.debian.org/security/2019/dsa-4547
