CVE-2017-13690

Vulnerability

The IKEv2 parser in tcpdump before version 4.9.2 contains a buffer over-read in several functions within print-isakmp.c. The issue occurs when processing crafted IKEv2 packets, specifically in the handling of payload lengths during printing. The vulnerability is reachable when tcpdump parses network traffic and has been assigned CVE-2017-13690 [3] [4].

Exploitation

An attacker can exploit this vulnerability by sending a malformed IKEv2 packet to a target system running an affected version of tcpdump. No authentication is required; the attacker only needs network access to the machine using tcpdump to capture traffic. When tcpdump processes the malicious packet, the insufficient bounds checking causes a buffer over-read [3].

Impact

Successful exploitation could lead to a denial of service via application crash or potentially allow arbitrary code execution with the privileges of the tcpdump process [4]. Additionally, the over-read may leak sensitive memory contents, depending on the specific exploitation scenario.

Mitigation

The vulnerability is fixed in tcpdump version 4.9.2; users should upgrade to this release or later [2] [3] [4]. Gentoo users can upgrade via emerge [4]. Apple addressed the issue in macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan [1]. No known workaround is available [4].