CVE-2023-1801

Vulnerability

The SMB protocol decoder in tcpdump version 4.99.3 performs an out-of-bounds write when decoding a crafted network packet. The vulnerability exists in the code path that handles SMB packets; no special configuration is required beyond using tcpdump to capture or process network traffic containing a maliciously crafted SMB packet [3][4].

Exploitation

An attacker can trigger this vulnerability by sending a specially crafted SMB packet over the network that is then captured and processed by tcpdump 4.99.3. No authentication is required, as the attacker only needs to be able to deliver the crafted packet to the target system where tcpdump is running. The vulnerability is reached during packet decoding without user interaction beyond running tcpdump in its normal operation [3][4].

Impact

Successful exploitation results in an out-of-bounds write, which can cause a crash or potentially allow arbitrary code execution in the context of the tcpdump process. This compromises the confidentiality, integrity, and availability of the system running the vulnerable version [3][4].

Mitigation

A fix has been implemented in the tcpdump repository by introducing a common routine nd_format_time for converting dates and times to strings, replacing vulnerable gmtime/strftime calls. Users should upgrade to a patched version of tcpdump beyond 4.99.3. As of the publication date, Apple’s security advisories for macOS (references [1] and [2]) do not mention this specific CVE; the vulnerability is in tcpdump itself, and users are advised to update the tcpdump package from their respective sources [3][4].