CVE-2019-1010220

Vulnerability

A buffer over-read vulnerability exists in tcpdump version 4.9.2 in the function print_prefix() located in print-hncp.c at line 234 [1][3]. The affected code performs an ND_PRINT call using the format "%s" on a buffer buf without proper bounds checking, leading to a CWE-126 buffer over-read condition [1]. This occurs when tcpdump parses a specially crafted pcap file [1].

Exploitation

An attacker must craft a malicious pcap file that triggers the over-read in print_prefix() [1]. The victim must open this file using tcpdump 4.9.2 [1][2]. No special network position or authentication is required; the attack vector is purely local file-based [1].

Impact

Successful exploitation can cause tcpdump to read beyond the intended buffer boundary, potentially exposing sensitive stack data such as the Saved Frame Pointer and Return Address [1]. In some configurations, an attacker might leverage this information disclosure to achieve arbitrary code execution [1][2].

Mitigation

The vulnerability is fixed in tcpdump version 4.9.3, released as part of USN-4252-1 and USN-4252-2 [1][2]. Ubuntu users should update to the package version 4.9.3-0ubuntu0.18.04.1 (for 18.04 LTS) or the equivalent for other supported releases [2]. Users of the upstream tcpdump should upgrade to version 4.9.3 or later [1]. No workaround is available for version 4.9.2.