CVE-2018-16229
📋 TL;DR
This vulnerability in tcpdump's DCCP parser allows attackers to cause a buffer over-read when processing malicious network packets. Systems running vulnerable versions of tcpdump that process DCCP traffic are affected, potentially leading to information disclosure or denial of service.
💻 Affected Systems
- tcpdump
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Leap by Opensuse
Leap by Opensuse
Tcpdump by Tcpdump
Tcpdump by Tcpdump
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if combined with other vulnerabilities, or sensitive memory disclosure revealing credentials or other confidential data.
Likely Case
Application crash (denial of service) or limited information disclosure from adjacent memory locations.
If Mitigated
Minimal impact if tcpdump runs with limited privileges and doesn't process untrusted DCCP traffic.
🎯 Exploit Status
Exploitation requires sending specially crafted DCCP packets to a system where tcpdump is running and processing those packets. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: tcpdump 4.9.3 and later
Vendor Advisory: https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
Restart Required: No
Instructions:
1. Update tcpdump using your distribution's package manager. 2. For Debian/Ubuntu: sudo apt update && sudo apt install tcpdump. 3. For RHEL/CentOS: sudo yum update tcpdump. 4. For source installation: download latest from https://www.tcpdump.org and compile.
🔧 Temporary Workarounds
Disable DCCP processing
allConfigure tcpdump to skip DCCP packets using BPF filters
tcpdump not dccp
Run with reduced privileges
linuxRun tcpdump with non-root user or capabilities to limit impact
sudo -u nobody tcpdump
🧯 If You Can't Patch
- Restrict tcpdump usage to trusted networks only
- Implement network segmentation to prevent untrusted DCCP traffic from reaching systems running tcpdump
🔍 How to Verify
Check if Vulnerable:
Run: tcpdump --version | head -1. If version is earlier than 4.9.3, system is vulnerable.Check Version:
tcpdump --version | head -1Verify Fix Applied:
Run: tcpdump --version | head -1. Confirm version is 4.9.3 or later.📡 Detection & Monitoring
Log Indicators:
- Segmentation fault or crash logs from tcpdump process
- Unexpected termination of tcpdump with error codes
Network Indicators:
- Unusual DCCP traffic patterns
- Malformed DCCP packets targeting systems known to run tcpdump
SIEM Query:
process_name:"tcpdump" AND (event_type:"crash" OR exit_code:139 OR exit_code:11)🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html
- http://seclists.org/fulldisclosure/2019/Dec/26
- https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
- https://github.com/the-tcpdump-group/tcpdump/commit/211124b972e74f0da66bc8b16f181f78793e2f66
- https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/
- https://seclists.org/bugtraq/2019/Dec/23
- https://seclists.org/bugtraq/2019/Oct/28
- https://security.netapp.com/advisory/ntap-20200120-0001/
- https://support.apple.com/kb/HT210788
- https://usn.ubuntu.com/4252-1/
- https://usn.ubuntu.com/4252-2/
- https://www.debian.org/security/2019/dsa-4547
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html
- http://seclists.org/fulldisclosure/2019/Dec/26
- https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
- https://github.com/the-tcpdump-group/tcpdump/commit/211124b972e74f0da66bc8b16f181f78793e2f66
- https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/
- https://seclists.org/bugtraq/2019/Dec/23
- https://seclists.org/bugtraq/2019/Oct/28
- https://security.netapp.com/advisory/ntap-20200120-0001/
- https://support.apple.com/kb/HT210788
- https://usn.ubuntu.com/4252-1/
- https://usn.ubuntu.com/4252-2/
- https://www.debian.org/security/2019/dsa-4547
