CVE-2018-16451

Vulnerability

The SMB parser in tcpdump before version 4.9.3 contains buffer over-reads in the print_trans() function in print-smb.c. This occurs when processing crafted SMB packets for the named pipes \MAILSLOT\BROWSE and \PIPE\LANMAN. The over-read can be triggered by capturing or analyzing malicious network traffic or a crafted packet capture file using the vulnerable tcpdump binary.

Exploitation

An attacker does not require authentication or any special network position to exploit this vulnerability. By injecting a specially crafted SMB packet into network traffic that a victim monitors with tcpdump, or by supplying a malicious packet capture file for offline analysis, the attacker can trigger the buffer over-read. No user interaction beyond running tcpdump on the affected data is required.

Impact

Successful exploitation could lead to information disclosure (reading beyond the bounds of the intended buffer, potentially leaking sensitive memory contents) or denial of service via application crash. In some scenarios, the over-read may be leveraged for arbitrary code execution, as noted in the Debian security advisory [4].

Mitigation

The vulnerability is fixed in tcpdump 4.9.3 [4]. Debian has released updated packages for the oldstable (stretch) and stable (buster) distributions under DSA-4547-1 [4]. Users should upgrade to tcpdump version 4.9.3 or later. No workarounds are available; the only remedy is to apply the update.