CVE-2018-14467
📋 TL;DR
This vulnerability in tcpdump's BGP parser allows attackers to cause a buffer over-read when processing specially crafted BGP packets. Systems running vulnerable versions of tcpdump that process BGP traffic are affected, potentially leading to information disclosure or denial of service.
💻 Affected Systems
- tcpdump
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Leap by Opensuse
Leap by Opensuse
Tcpdump by Tcpdump
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, though this is unlikely given the nature of buffer over-read vulnerabilities.
Likely Case
Denial of service (tcpdump crash) or information disclosure (reading beyond buffer boundaries).
If Mitigated
Minimal impact if tcpdump is not processing BGP traffic or is running with limited privileges.
🎯 Exploit Status
Exploitation requires sending specially crafted BGP packets to a system where tcpdump is monitoring network traffic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.9.3 and later
Vendor Advisory: https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
Restart Required: No
Instructions:
1. Update tcpdump to version 4.9.3 or later using your package manager. 2. For Linux: 'sudo apt update && sudo apt upgrade tcpdump' (Debian/Ubuntu) or 'sudo yum update tcpdump' (RHEL/CentOS). 3. Verify installation with 'tcpdump --version'.
🔧 Temporary Workarounds
Disable BGP packet processing
allAvoid using tcpdump with BGP packet analysis capabilities
Avoid using '-B' flag or analyzing BGP protocol traffic
Run tcpdump with reduced privileges
linuxLimit potential impact by running tcpdump as non-root user
sudo -u nobody tcpdump [options]
🧯 If You Can't Patch
- Restrict network access to systems running vulnerable tcpdump versions
- Monitor for crashes or abnormal behavior in tcpdump processes
🔍 How to Verify
Check if Vulnerable:
Run 'tcpdump --version' and check if version is earlier than 4.9.3Check Version:
tcpdump --version | head -1Verify Fix Applied:
Confirm tcpdump version is 4.9.3 or later with 'tcpdump --version | head -1'📡 Detection & Monitoring
Log Indicators:
- tcpdump segmentation faults or crashes
- unexpected termination of tcpdump processes
Network Indicators:
- Malformed BGP packets targeting systems running tcpdump
SIEM Query:
process_name="tcpdump" AND (event_type="crash" OR exit_code="139")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html
- http://seclists.org/fulldisclosure/2019/Dec/26
- https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
- https://github.com/the-tcpdump-group/tcpdump/commit/e3f3b445e2d20ac5d5b7fcb7559ce6beb55da0c9
- https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/
- https://seclists.org/bugtraq/2019/Dec/23
- https://seclists.org/bugtraq/2019/Oct/28
- https://security.netapp.com/advisory/ntap-20200120-0001/
- https://support.apple.com/kb/HT210788
- https://usn.ubuntu.com/4252-1/
- https://usn.ubuntu.com/4252-2/
- https://www.debian.org/security/2019/dsa-4547
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html
- http://seclists.org/fulldisclosure/2019/Dec/26
- https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
- https://github.com/the-tcpdump-group/tcpdump/commit/e3f3b445e2d20ac5d5b7fcb7559ce6beb55da0c9
- https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/
- https://seclists.org/bugtraq/2019/Dec/23
- https://seclists.org/bugtraq/2019/Oct/28
- https://security.netapp.com/advisory/ntap-20200120-0001/
- https://support.apple.com/kb/HT210788
- https://usn.ubuntu.com/4252-1/
- https://usn.ubuntu.com/4252-2/
- https://www.debian.org/security/2019/dsa-4547
