VYPR
← All advisories
Unrated severityNVD Advisory· Published Oct 3, 2019· Updated Dec 17, 2025

CVE-2018-14465

CVE-2018-14465

Description

A buffer over-read in tcpdump's RSVP parser before version 4.9.3 can lead to denial of service or potential arbitrary code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A buffer over-read in tcpdump's RSVP parser before version 4.9.3 can lead to denial of service or potential arbitrary code execution.

Vulnerability

CVE-2018-14465 is a buffer over-read vulnerability in the RSVP parser of tcpdump, a command-line network traffic analyzer. The bug resides in the rsvp_obj_print() function in print-rsvp.c. Tcpdump versions before 4.9.3, including those shipped in Ubuntu 12.04 ESM, 14.04 ESM, and 18.04 LTS as well as older macOS versions, are affected [2][3]. The vulnerability is triggered when tcpdump processes a specially crafted RSVP packet.

Exploitation

An attacker can exploit this vulnerability by sending a malicious RSVP packet to a target running a vulnerable version of tcpdump on a network interface in promiscuous or monitor mode. No authentication or user interaction is required beyond tcpdump capturing the packet; the attacker only needs the ability to inject network traffic that reaches the victim's network interface. The over-read occurs during parsing of the malformed packet data [1][4].

Impact

Successful exploitation can cause tcpdump to crash, resulting in a denial of service. More critically, the buffer over-read could potentially be leveraged to achieve arbitrary code execution with the privileges of tcpdump (typically root when started with elevated capabilities). This impact is noted in the Ubuntu security advisories [2][3] and Apple's security content [1].

Mitigation

The vulnerability is fixed in tcpdump version 4.9.3, released in 2018. Users should upgrade to tcpdump 4.9.3 or later. For Ubuntu systems, the fixed package version is 4.9.3-0ubuntu0.18.04.1 for 18.04 LTS [3], and similar updates are available for other releases [2]. Apple addressed this vulnerability when fixed tcpdump was included in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra, released December 10, 2019 [1][4]. There are no known workarounds; updating tcpdump is the recommended mitigation.

References
  1. About the security content of macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra - Apple Support
  2. USN-4252-2: tcpdump vulnerabilities | Ubuntu security notices | Ubuntu
  3. USN-4252-1: tcpdump vulnerabilities | Ubuntu security notices | Ubuntu
  4. APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

10

Patches

2
d9a693b04326

VERSION set for release

https://github.com/the-tcpdump-group/tcpdumpMichael RichardsonSep 30, 2019via osv
commit
1 file changed · +1 −1
  • VERSION+1 −1 modified
    @@ -1 +1 @@
-4.9.3rc2
+4.9.3
bea2686c296b

(for 4.9.3) CVE-2018-14465/RSVP: Add a missing bounds check

https://github.com/the-tcpdump-group/tcpdumpFrancois-Xavier Le BailOct 8, 2017via osv
commit
4 files changed · +9 −0
  • print-rsvp.c+1 −0 modified
    @@ -1555,6 +1555,7 @@ rsvp_obj_print(netdissect_options *ndo,
         case RSVP_OBJ_CLASSTYPE_OLD: /* fall through */
             switch(rsvp_obj_ctype) {
             case RSVP_CTYPE_1:
+                ND_TCHECK_32BITS(obj_tptr);
                 ND_PRINT((ndo, "%s  CT: %u",
                        ident,
                        EXTRACT_32BITS(obj_tptr) & 0x7));
  • tests/rsvp-rsvp_obj_print-oobr.out+7 −0 added
    @@ -0,0 +1,7 @@
+TIPC v5.0 226.0.0 > 64.14.1536, headerlength 56 bytes, MessageSize 51914 bytes, Link Changeover Protocol internal, messageType Unknown (0xcacacaca)[|TIPC]
+[|ether]
+IP (tos 0x0, ttl 14, id 44815, offset 0, flags [+, DF, rsvd], proto RSVP (46), length 40, bad cksum 3280 (->c411)!)
+    250.219.91.71 > 20.100.238.255: 
+	RSVPv1 Hello Message (20), Flags: [none], length: 16384, ttl: 0, checksum: 0x000e
+	  Class Type (old) Object (125) Flags: [reject if unknown], Class-Type: 1 (1), length: 4
+		 [|rsvp]
  • tests/rsvp-rsvp_obj_print-oobr.pcap+0 −0 added
  • tests/TESTLIST+1 −0 modified
    @@ -555,6 +555,7 @@ isakmp-ikev1_n_print-oobr isakmp-ikev1_n_print-oobr.pcap isakmp-ikev1_n_print-oo
 ldp-ldp_tlv_print-oobr ldp-ldp_tlv_print-oobr.pcap ldp-ldp_tlv_print-oobr.out -v -c1
 icmp-icmp_print-oobr-1 icmp-icmp_print-oobr-1.pcap icmp-icmp_print-oobr-1.out -v -c3
 icmp-icmp_print-oobr-2 icmp-icmp_print-oobr-2.pcap icmp-icmp_print-oobr-2.out -v -c3
+rsvp-rsvp_obj_print-oobr rsvp-rsvp_obj_print-oobr.pcap rsvp-rsvp_obj_print-oobr.out -v -c3
 # The .pcap file is truncated after the 1st packet.
 hncp_dhcpv6data-oobr	hncp_dhcpv6data-oobr.pcap	hncp_dhcpv6data-oobr.out -v -c1
 hncp_dhcpv4data-oobr	hncp_dhcpv4data-oobr.pcap	hncp_dhcpv4data-oobr.out -v -c1

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

16

News mentions

0

No linked articles in our index yet.