CVE-2017-13687

Vulnerability

A buffer over-read vulnerability exists in the Cisco HDLC (CHDLC) parser in tcpdump versions before 4.9.2. The flaw resides in the chdlc_print() function in print-chdlc.c. The function does not properly validate the length of the input before parsing protocol fields, leading to a buffer over-read when processing malformed packets [4]. Affected versions include all tcpdump releases prior to 4.9.2.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious CHDLC packet and causing it to be processed by a victim running a vulnerable version of tcpdump. The attacker does not need authentication or special privileges; simply sending the packet over a network being monitored by the victim can trigger the over-read.

Impact

Successful exploitation results in a buffer over-read, which may lead to information disclosure (reading of sensitive memory contents) or denial of service (crash of tcpdump). The impact is limited to the tcpdump process and does not grant code execution directly.

Mitigation

The vulnerability is fixed in tcpdump version 4.9.2 [2]. Red Hat has released updated packages (tcpdump-4.9.2-3.el7) [2]. Apple has included the fix in macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan [1]. Users should upgrade to the fixed version or apply the appropriate vendor patches. There is no known workaround.