CVE-2018-10105

Vulnerability

A vulnerability in tcpdump versions prior to 4.9.3 mishandles the printing of SMB (Server Message Block) protocol data. When tcpdump processes a specially crafted SMB packet, it can trigger an improper memory access due to a flaw in how the packet data is decoded and printed. This issue affects multiple UNIX-like systems, including those using Apple macOS and Ubuntu Linux distributions. The bug is specifically related to SMB packet handling and is the second of two related issues identified in tcpdump's SMB printing code [1][2][3][4].

Exploitation

An attacker can exploit this vulnerability by sending a crafted SMB network packet to a system where tcpdump is actively capturing traffic. No authentication is required, as the packet can be delivered over the network if the victim runs tcpdump in promiscuous mode to monitor traffic. The victim does not need to respond to the packet; simply receiving and processing it with tcpdump's packet parsing ability is sufficient to trigger the flaw. Successful exploitation may cause tcpdump to crash or potentially allow arbitrary code execution [2][3].

Impact

If exploited, this vulnerability could lead to a denial of service by causing tcpdump to crash, disrupting network monitoring activities. In more severe cases, a remote attacker might be able to execute arbitrary code with the privileges of the tcpdump process, which is typically run as root or with elevated privileges. This could result in full compromise of the affected system [2][3].

Mitigation

The vulnerability is fixed in tcpdump version 4.9.3 and later. The official fix was released upstream and is included in the tcpdump 4.9.3 changelog [4]. For Ubuntu systems, updates are available in version 4.9.3-0ubuntu0.18.04.1 for Ubuntu 18.04 LTS and corresponding versions for other releases [3]. Apple addressed this issue in macOS Catalina 10.15.2 and subsequent updates, though their advisory does not explicitly list this CVE [1]. Users should update to the latest version of tcpdump or apply the appropriate security patches from their operating system vendor. No workaround is available; updating is the recommended action.