Buffer overflow in tcpdump (Alpine package)

1) Buffer overflow

EUVDB-ID: #VU6812

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2016-7938

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allow a remote attacker to cause DoS condition or potentially execute arbitrary code on the target system.

The weakness exists due to buffer overflow in the print-zeromq.c:zmtp1_print_frame() in the ZeroMQ parser. A remote attacker can use a specially crafted protocol to trigger memory corruption and cause the application to crash or possibly execute arbitrary code.

Successful exploitation of the vulnerability may result system compromise.

Mitigation

Install update from vendor's website.

Vulnerable software versions

tcpdump (Alpine package): 4.3.0-r0 - 4.7.4-r2

CPE2.3

• cpe:2.3:o:alpine:tcpdump_alpine_package:4.3.0-r0:*:*:*:*:alpine_linux:*:2.5
• cpe:2.3:o:alpine:tcpdump_alpine_package:4.6.2-r0:*:*:*:*:alpine_linux:*:3.1
• cpe:2.3:o:alpine:tcpdump_alpine_package:4.7.4-r0:*:*:*:*:alpine_linux:*:3.2

External links

https://git.alpinelinux.org/aports/commit/?id=463c720cae55a3f0c45d5b52bc6da81e2fbe307e
https://git.alpinelinux.org/aports/commit/?id=a9f20ceec7434edc3b6efaaf3d9117504437d0d0
https://git.alpinelinux.org/aports/commit/?id=3ef6a6d85712fb0068f7b211c3e105a446f3af5b
https://git.alpinelinux.org/aports/commit/?id=c1a6c375d61229ad81ad0d61a67cd9cb3b900c94
https://git.alpinelinux.org/aports/commit/?id=daee30e03d94d9048b5b2d3da5dc1164cacea65f
https://git.alpinelinux.org/aports/commit/?id=889fe674354b8ffbce03fdbfb24f5b03f1520291

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.