VYPR
← All advisories
Unrated severityNVD Advisory· Published Oct 3, 2019· Updated Dec 3, 2025

CVE-2018-14881

CVE-2018-14881

Description

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_RESTART).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_RESTART).

Vulnerability

A buffer over-read exists in the BGP parser of tcpdump versions prior to 4.9.3 [4]. The flaw is located in the bgp_capabilities_print() function within print-bgp.c when processing the BGP_CAPCODE_RESTART capability. The over-read occurs due to insufficient bounds checking on the input data, allowing read operations beyond the allocated buffer [1][2][3][4].

Exploitation

An attacker can trigger the buffer over-read by crafting a malicious BGP packet and sending it to a target system running a vulnerable version of tcpdump. The attacker does not require authentication or any special network position beyond being able to deliver the packet to the tcpdump process, such as through a network capture session. The vulnerability is exercised when tcpdump parses the BGP capabilities, leading to the over-read [1][2][3][4].

Impact

Successful exploitation can result in a denial of service due to a crash or, potentially, the execution of arbitrary code, depending on how the over-read is leveraged. The attacker may be able to read sensitive memory or cause the application to behave unexpectedly [4].

Mitigation

The vulnerability is fixed in tcpdump version 4.9.3 [4]. Users should upgrade to tcpdump 4.9.3 or later. Debian distributions have released updates (4.9.3-1~deb9u1 for stretch, 4.9.3-1~deb10u1 for buster) [4]. No workaround is available; updating the software is the recommended mitigation.

References
  1. About the security content of macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra - Apple Support
  2. APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra
  3. APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra
  4. [SECURITY] [DSA 4547-1] tcpdump security update

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

10

Patches

2
d9a693b04326

VERSION set for release

https://github.com/the-tcpdump-group/tcpdumpMichael RichardsonSep 30, 2019via osv
commit
1 file changed · +1 −1
  • VERSION+1 −1 modified
    @@ -1 +1 @@
-4.9.3rc2
+4.9.3
86326e880d31

(for 4.9.3) CVE-2018-14881/BGP: Fix BGP_CAPCODE_RESTART.

https://github.com/the-tcpdump-group/tcpdumpFrancois-Xavier Le BailOct 8, 2017via osv
commit
4 files changed · +30 −0
  • print-bgp.c+2 −0 modified
    @@ -2351,6 +2351,8 @@ bgp_capabilities_print(netdissect_options *ndo,
                            opt[i+5]));
                     break;
                 case BGP_CAPCODE_RESTART:
+                    /* Restart Flags (4 bits), Restart Time in seconds (12 bits) */
+                    ND_TCHECK_16BITS(opt + i + 2);
                     ND_PRINT((ndo, "\n\t\tRestart Flags: [%s], Restart Time %us",
                            ((opt[i+2])&0x80) ? "R" : "none",
                            EXTRACT_16BITS(opt+i+2)&0xfff));
  • tests/bgp-bgp_capabilities_print-oobr-1.out+27 −0 added
    @@ -0,0 +1,27 @@
+IP (tos 0x1f,CE, ttl 254, id 38671, offset 0, flags [+, DF, rsvd], proto TCP (6), length 4135, bad cksum 200 (->1fdd)!)
+    226.219.0.0.179 > 16.233.34.0.100: Flags [SPUE], seq 347537408:347541483, win 511, urg 65535, options [eol], length 4075: BGP [|BGP]
+	Open Message (1), length: 59
+	  Version 255, my AS 65528, Holdtime 4324s, ID 144.8.32.4
+	  Optional parameters, length: 29
+	    Option Unknown (0), length: 0
+	      no decoder for option 0
+	    Option Capabilities Advertisement (2), length: 8
+	      Graceful Restart (64), length: 0
+		Restart Flags: [none], Restart Time 0s
+	      Unknown (0), length: 0
+		no decoder for Capability 0
+	      32-Bit AS Number (65), length: 4
+		 4 Byte AS 2
+	    Option Unknown (0), length: 2
+	      no decoder for option 0
+	    Option Capabilities Advertisement (2), length: 2
+	      Unknown (232), length: 3
+		no decoder for Capability 232
+		0x0000:  0207 04
+	    Option Capabilities Advertisement (2), length: 7
+	      Multiple Routes to a Destination (4), length: 0
+		no decoder for Capability 4
+	      Unknown (8), length: 0
+		no decoder for Capability 8
+	      Route Refresh (Cisco) (128), length: 0
+	      Graceful Restart (64), length: 0[|BGP]
  • tests/bgp-bgp_capabilities_print-oobr-1.pcap+0 −0 added
  • tests/TESTLIST+1 −0 modified
    @@ -557,6 +557,7 @@ icmp-icmp_print-oobr-1 icmp-icmp_print-oobr-1.pcap icmp-icmp_print-oobr-1.out -v
 icmp-icmp_print-oobr-2 icmp-icmp_print-oobr-2.pcap icmp-icmp_print-oobr-2.out -v -c3
 rsvp-rsvp_obj_print-oobr rsvp-rsvp_obj_print-oobr.pcap rsvp-rsvp_obj_print-oobr.out -v -c3
 vrrp-vrrp_print-oobr vrrp-vrrp_print-oobr.pcap vrrp-vrrp_print-oobr.out -v -c3
+bgp-bgp_capabilities_print-oobr-1 bgp-bgp_capabilities_print-oobr-1.pcap bgp-bgp_capabilities_print-oobr-1.out -v -c1
 # The .pcap file is truncated after the 1st packet.
 hncp_dhcpv6data-oobr	hncp_dhcpv6data-oobr.pcap	hncp_dhcpv6data-oobr.out -v -c1
 hncp_dhcpv4data-oobr	hncp_dhcpv4data-oobr.pcap	hncp_dhcpv4data-oobr.out -v -c1

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

16

News mentions

0

No linked articles in our index yet.