CVE-2014-8767: Medium severity tcpdump vulnerability
Published Nov 20, 2014
·Updated
Integer underflow in the olsrprint function in tcpdump 3.9.6 through 4.6.2, when in verbose mode, allows remote attackers to cause a denial of service (crash) via a crafted length value in an OLSR frame.
Affected Software
19 affected components
redhat Tcpdump=3.9.6
redhat Tcpdump=3.9.7
redhat Tcpdump=3.9.8
redhat Tcpdump=4.0.0
redhat Tcpdump=4.1.0
redhat Tcpdump=4.1.1
redhat Tcpdump=4.1.2
redhat Tcpdump=4.2.1
redhat Tcpdump=4.3.0
redhat Tcpdump=4.3.1
redhat Tcpdump=4.4.0
redhat Tcpdump=4.5.0
redhat Tcpdump=4.5.1
redhat Tcpdump=4.5.2
redhat Tcpdump=4.6.0
redhat Tcpdump=4.6.1
redhat Tcpdump=4.6.2
openSUSE openSUSE=13.1
openSUSE openSUSE=13.2
Event History
Nov 20, 2014
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-8767?
CVE-2014-8767 is classified as a high severity vulnerability due to its potential to cause a denial of service.
2
How do I fix CVE-2014-8767?
To fix CVE-2014-8767, upgrade tcpdump to version 4.6.3 or later, as this version includes the necessary patch.
3
What versions of tcpdump are affected by CVE-2014-8767?
Affected tcpdump versions include 3.9.6 through 4.6.2.
4
What kind of attack does CVE-2014-8767 facilitate?
CVE-2014-8767 facilitates a denial of service attack that can crash the tcpdump application.
5
Is there a workaround for CVE-2014-8767?
A potential workaround for CVE-2014-8767 is to avoid using the verbose mode in tcpdump until the vulnerability is resolved.