CVE-2017-11108

Vulnerability

In tcpdump version 4.9.0, the stp_print function for the Spanning Tree Protocol (STP) incorrectly uses the EXTRACT_16BITS macro, resulting in a heap-based buffer over-read when processing a specially crafted packet. This vulnerability can be triggered remotely by an attacker sending a malicious STP packet to a system running tcpdump, requiring no authentication or special privileges. [2][3][4]

Exploitation

An attacker with network access can exploit this vulnerability by sending a crafted STP packet to the target system running tcpdump. The packet triggers the over-read in the stp_print function, leading to an application crash. No user interaction or elevated privileges are required. [2][3][4]

Impact

Successful exploitation causes a denial of service condition via application crash. The heap-based buffer over-read may lead to information disclosure in some scenarios, but the primary impact is a denial of service. [2][3][4]

Mitigation

The vulnerability is fixed in tcpdump version 4.9.2 and later. Red Hat Enterprise Linux 7 updated to tcpdump-4.9.2-3.el7 [2]. Gentoo users should upgrade to >=net-analyzer/tcpdump-4.9.2 [4]. No temporary workarounds are available; upgrading is recommended. The vulnerability has not been added to the Known Exploited Vulnerabilities (KEV) catalog. [2][3][4]