CVE-2018-14469
📋 TL;DR
CVE-2018-14469 is a buffer over-read vulnerability in tcpdump's IKEv1 parser that allows attackers to cause denial of service or potentially leak sensitive information from memory. Systems running vulnerable versions of tcpdump that process IKEv1 network traffic are affected. The vulnerability exists in the print-isakmp.c file's ikev1_n_print() function.
💻 Affected Systems
- tcpdump
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Leap by Opensuse
Leap by Opensuse
Tcpdump by Tcpdump
Tcpdump by Tcpdump
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, though this is unlikely given the buffer over-read nature.
Likely Case
Denial of service through application crash or information disclosure via memory content leakage.
If Mitigated
Limited impact with proper network segmentation and updated software.
🎯 Exploit Status
Exploitation requires sending specially crafted IKEv1 packets to systems where tcpdump is processing network traffic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.9.3 and later
Vendor Advisory: https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
Restart Required: No
Instructions:
1. Update tcpdump to version 4.9.3 or later using your system's package manager. 2. For Linux: 'sudo apt update && sudo apt upgrade tcpdump' (Debian/Ubuntu) or 'sudo yum update tcpdump' (RHEL/CentOS). 3. Verify installation with 'tcpdump --version'.
🔧 Temporary Workarounds
Disable IKEv1 parsing
linuxAvoid parsing IKEv1 packets by using tcpdump filters
tcpdump not port 500 and not port 4500
Restrict tcpdump usage
linuxLimit tcpdump execution to trusted users and networks
chmod 750 /usr/sbin/tcpdump
setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump
🧯 If You Can't Patch
- Implement network filtering to block IKEv1 traffic (ports 500 and 4500) from untrusted sources
- Restrict tcpdump usage to specific trusted users and monitor for crashes or unusual behavior
🔍 How to Verify
Check if Vulnerable:
Run 'tcpdump --version' and check if version is below 4.9.3Check Version:
tcpdump --version 2>&1 | head -1Verify Fix Applied:
Run 'tcpdump --version' and confirm version is 4.9.3 or higher📡 Detection & Monitoring
Log Indicators:
- tcpdump segmentation faults
- unexpected tcpdump process termination
- core dumps from tcpdump
Network Indicators:
- Unusual IKEv1 traffic patterns
- Malformed IKEv1 packets to monitoring systems
SIEM Query:
process_name:"tcpdump" AND (event_type:"crash" OR exit_code:139 OR exit_code:11)🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html
- http://seclists.org/fulldisclosure/2019/Dec/26
- https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
- https://github.com/the-tcpdump-group/tcpdump/commit/396e94ff55a80d554b1fe46bf107db1e91008d6c
- https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/
- https://seclists.org/bugtraq/2019/Dec/23
- https://seclists.org/bugtraq/2019/Oct/28
- https://security.netapp.com/advisory/ntap-20200120-0001/
- https://support.apple.com/kb/HT210788
- https://usn.ubuntu.com/4252-1/
- https://usn.ubuntu.com/4252-2/
- https://www.debian.org/security/2019/dsa-4547
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html
- http://seclists.org/fulldisclosure/2019/Dec/26
- https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
- https://github.com/the-tcpdump-group/tcpdump/commit/396e94ff55a80d554b1fe46bf107db1e91008d6c
- https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/
- https://seclists.org/bugtraq/2019/Dec/23
- https://seclists.org/bugtraq/2019/Oct/28
- https://security.netapp.com/advisory/ntap-20200120-0001/
- https://support.apple.com/kb/HT210788
- https://usn.ubuntu.com/4252-1/
- https://usn.ubuntu.com/4252-2/
- https://www.debian.org/security/2019/dsa-4547
