CVE-2019-15167

Vulnerability

A buffer over-read vulnerability exists in the VRRP (Virtual Router Redundancy Protocol) packet parser in tcpdump versions prior to 4.9.3. Specifically, the function vrrp_print() in print-vrrp.c lacks a necessary bounds check when processing VRRP version 3 advertisements, causing the parser to read beyond the allocated packet buffer. The issue is distinct from CVE-2018-14463, which affects a different part of the same parser. [1]

Exploitation

An attacker can exploit this vulnerability by crafting a malicious VRRPv3 packet with specially crafted header fields. The target system must be running a vulnerable version of tcpdump and have it actively capturing network traffic. When tcpdump processes the malicious packet, the missing bounds check in vrrp_print() results in a heap or stack buffer over-read. No authentication or special privileges are required to send the packet over the network. [1]

Impact

Successful exploitation leads to a buffer over-read, which may cause tcpdump to read memory beyond the packet buffer. This can result in information disclosure (exposure of adjacent memory contents) or a crash (denial of service). The vulnerability does not appear to enable remote code execution. [1]

Mitigation

The vulnerability is fixed in tcpdump version 4.9.3, released on November 14, 2019. Users should upgrade to this version or later. No workarounds are available; the only mitigation is to avoid running tcpdump on untrusted network traffic until patched. [1]