CVE-2018-16452

Vulnerability

The SMB parser in tcpdump before version 4.9.3 contains a stack exhaustion vulnerability in the smb_fdata() function within smbutil.c. This occurs due to uncontrolled recursion when processing crafted SMB packets, leading to a crash. The issue affects all versions prior to 4.9.3, as confirmed by the Debian security advisory [4].

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted SMB packet to a target system that is running an affected version of tcpdump and capturing network traffic. No authentication or special privileges are required; the attacker only needs the ability to transmit packets visible to the target's tcpdump instance. The malicious packet triggers deep recursion in smb_fdata(), consuming the stack space and causing the process to crash.

Impact

Successful exploitation results in a denial of service (crash) of the tcpdump process. There is no indication of arbitrary code execution or information disclosure; the primary impact is loss of availability for network monitoring and analysis tools relying on tcpdump.

Mitigation

The vulnerability is fixed in tcpdump version 4.9.3. For Debian systems, updates have been released for the oldstable (stretch) and stable (buster) distributions as per DSA-4547-1 [4]. Users are advised to upgrade to the latest available patched version. If upgrading is not immediately possible, avoiding the capture or parsing of untrusted SMB traffic may reduce risk.