CVE-2017-13689

Vulnerability

The vulnerability is a buffer over-read in the IKEv1 parser of tcpdump versions prior to 4.9.2. It resides in the ikev1_id_print() function in print-isakmp.c. For the IPSECDOI_ID_IPV6_ADDR_SUBNET type, the length check was insufficient (checked < 20 instead of < 32), allowing an over-read when processing crafted ISAKMP packets. [3]

Exploitation

An attacker can exploit this by sending a specially crafted IKEv1 packet to a system running tcpdump. No authentication is required; the attacker only needs network access. The target must be capturing or monitoring traffic. The over-read occurs when the identifier data length is less than expected. [3][4]

Impact

Successful exploitation can cause a denial of service (crash) or potentially lead to arbitrary code execution in the context of the tcpdump process. [4] The over-read may also leak sensitive memory contents. [2]

Mitigation

The vulnerability is fixed in tcpdump version 4.9.2. [3] Users should upgrade to this version or later. Red Hat provides updated packages [2], and Gentoo recommends upgrading to >=net-analyzer/tcpdump-4.9.2. [4] No workarounds are known.