CVE-2016-7922: Buffer Overflow
Multiple buffer overflows, and one integer overflow, in protocol decoding were found that may cause incorrect decoding, segmentation fault or (in the case of integer overflow) an infinite loop. These issues can be be exploited either locally, by making the target user decode a crafted .pcap file using tcpdump, or remotely by sending crafted packets to the network segment where the target system is running tcpdump decoding the live packet capture. Ability to send crafted packets to the target network segment is limited by the protocols' ability to cross network segments, or presence of firewall rules.
Upstream changelog:
http://www.tcpdump.org/tcpdump-changes.txt
Other sources
The AH parser in tcpdump before 4.9.0 has a buffer overflow in print-ah.c:ahprint().
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7922?
CVE-2016-7922 has been classified as having medium severity due to its potential to cause segmentation faults and infinite loops.
How do I fix CVE-2016-7922?
To fix CVE-2016-7922, upgrade tcpdump to version 4.9.0 or later.
What types of vulnerabilities are associated with CVE-2016-7922?
CVE-2016-7922 is associated with multiple buffer overflows and one integer overflow within protocol decoding.
Can CVE-2016-7922 be exploited remotely?
CVE-2016-7922 can be exploited locally when the target user decodes a crafted .pcap file.
What software versions are affected by CVE-2016-7922?
CVE-2016-7922 affects tcpdump versions up to and including 4.8.1, with an upgrade required to version 4.9.0.