CVE-2017-13725

Vulnerability

A buffer over-read vulnerability exists in the rt6_print() function in print-rt6.c of tcpdump versions prior to 4.9.2. The function does not properly validate the length of the IPv6 routing header before reading fields such as ip6r_len and ip6r_segleft, leading to an out-of-bounds read when processing a crafted packet [4].

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted IPv6 packet containing a malformed routing header to a target system running an affected version of tcpdump. No authentication or user interaction is required; the attacker only needs network access to deliver the packet. When tcpdump captures and parses the packet, the over-read occurs, potentially causing a crash or leaking memory contents [3].

Impact

Successful exploitation can result in a denial of service (application crash) or, in the worst case, arbitrary code execution with the privileges of the tcpdump process [3]. Additionally, the buffer over-read may disclose sensitive information from the process's memory. The CVSS v3 score is 9.8 (Critical), reflecting the remote, unauthenticated nature of the attack and the potential for full compromise.

Mitigation

The vulnerability is fixed in tcpdump version 4.9.2 [4]. Red Hat Enterprise Linux 7 users can update to tcpdump-4.9.2-3.el7 [2]. Gentoo users should upgrade to >=net-analyzer/tcpdump-4.9.2 [3]. No workarounds are available; upgrading is the only mitigation.