CVE-2018-14879
📋 TL;DR
CVE-2018-14879 is a buffer overflow vulnerability in tcpdump's command-line argument parser that allows attackers to execute arbitrary code or cause denial of service. This affects systems running tcpdump versions before 4.9.3. Anyone using vulnerable tcpdump versions to analyze network traffic could be impacted.
💻 Affected Systems
- tcpdump
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Leap by Opensuse
Leap by Opensuse
Tcpdump by Tcpdump
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the tcpdump process, potentially leading to full system compromise.
Likely Case
Denial of service through application crash when processing malicious command-line arguments.
If Mitigated
Limited impact if tcpdump runs with minimal privileges and proper input validation is in place.
🎯 Exploit Status
Exploitation requires ability to control tcpdump command-line arguments, typically requiring some level of access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.9.3 and later
Vendor Advisory: https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
Restart Required: No
Instructions:
1. Update tcpdump using your distribution's package manager. 2. For source installations: download tcpdump 4.9.3+ from the-tcpdump-group/tcpdump GitHub repository. 3. Compile and install the updated version.
🔧 Temporary Workarounds
Restrict tcpdump usage
linuxLimit who can run tcpdump and control command-line arguments
sudo chmod 750 /usr/sbin/tcpdump
sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump
Use alternative tools
linuxReplace tcpdump with alternative packet analyzers like Wireshark (tshark) or tcpflow
sudo apt-get install wireshark-tshark
sudo yum install wireshark
🧯 If You Can't Patch
- Run tcpdump with minimal privileges using capabilities or SELinux/AppArmor restrictions
- Implement strict input validation for any scripts or tools that invoke tcpdump with user-supplied arguments
🔍 How to Verify
Check if Vulnerable:
Run: tcpdump --version | head -1 | grep -q 'tcpdump version 4\.9\.[0-2]\|tcpdump version 4\.[0-8]\|tcpdump version [0-3]' && echo 'VULNERABLE' || echo 'SAFE'Check Version:
tcpdump --version | head -1Verify Fix Applied:
Run: tcpdump --version | head -1 | grep -q 'tcpdump version 4\.9\.[3-9]\|tcpdump version [5-9]\|tcpdump version 1[0-9]' && echo 'PATCHED' || echo 'STILL VULNERABLE'📡 Detection & Monitoring
Log Indicators:
- Segmentation fault or crash logs from tcpdump process
- Unusual command-line arguments passed to tcpdump
Network Indicators:
- Unexpected network traffic from systems running tcpdump
SIEM Query:
process_name:tcpdump AND (event_type:crash OR cmdline:*\"* OR cmdline:*'*)🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html
- http://seclists.org/fulldisclosure/2019/Dec/26
- https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
- https://github.com/the-tcpdump-group/tcpdump/commit/9ba91381954ad325ea4fd26b9c65a8bd9a2a85b6
- https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/
- https://seclists.org/bugtraq/2019/Dec/23
- https://seclists.org/bugtraq/2019/Oct/28
- https://security.netapp.com/advisory/ntap-20200120-0001/
- https://support.apple.com/kb/HT210788
- https://support.f5.com/csp/article/K51512510?utm_source=f5support&%3Butm_medium=RSS
- https://usn.ubuntu.com/4252-1/
- https://usn.ubuntu.com/4252-2/
- https://www.debian.org/security/2019/dsa-4547
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html
- http://seclists.org/fulldisclosure/2019/Dec/26
- https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
- https://github.com/the-tcpdump-group/tcpdump/commit/9ba91381954ad325ea4fd26b9c65a8bd9a2a85b6
- https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/
- https://seclists.org/bugtraq/2019/Dec/23
- https://seclists.org/bugtraq/2019/Oct/28
- https://security.netapp.com/advisory/ntap-20200120-0001/
- https://support.apple.com/kb/HT210788
- https://support.f5.com/csp/article/K51512510?utm_source=f5support&%3Butm_medium=RSS
- https://usn.ubuntu.com/4252-1/
- https://usn.ubuntu.com/4252-2/
- https://www.debian.org/security/2019/dsa-4547
