Every CVE Search/ Get API key

CVE-2004-0184

Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to...

5.0 MediumPublic exploitFix available

Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with an Identification payload with a length that becomes less than 8 during byte order conversion, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.

Exploit likelihood

60.3%Up 47.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with an Identification payload with a length that becomes less than 8 during byte order conversion, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.

Record
CVE-2004-0184
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-125, CWE-191
Updated
2026-11-02
CVE List No score

Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with an Identification payload with a length that becomes less than 8 during byte order conversion, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.

Record
CVE-2004-0184
Updated
2026-11-02
EUVDEUVD-2004-0184 No score

Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with an Identification payload with a length that becomes less than 8 during byte order conversion, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.

Record
EUVD-2004-0184
Updated
2026-11-03
GitHub AdvisoriesGHSA-rm38-jqfm-qmjm No score

Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to...

Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with an Identification payload with a length that becomes less than 8 during byte order conversion, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.

Record
GHSA-rm38-jqfm-qmjm
Weakness
CWE-125
Updated
2026-11-02
OSV No score

Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with an Identification payload with a length that becomes less than 8 during byte order conversion, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.

Record
CVE-2004-0184
Updated
2026-11-02
OSVDEBIAN-CVE-2004-0184 No score

Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with an Identification payload with a length that becomes less than 8 during byte order conversion, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.

Record
DEBIAN-CVE-2004-0184
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tcpdump
Debian:12
 before 3.7.2-4
3.7.2-4
tcpdump
Debian:13
 before 3.7.2-4
3.7.2-4
tcpdump
Debian:14
 before 3.7.2-4
3.7.2-4
tcpdump
Debian:3.0
 before 3.6.2-2.8
3.6.2-2.8
libpcap
Red Hat:enterprise_linux:3::as
 before 14:0.7.2-7.E3.2
14:0.7.2-7.E3.2
tcpdump
Red Hat:enterprise_linux:3::as
 before 14:3.7.2-7.E3.2
14:3.7.2-7.E3.2
tcpdump-debuginfo
Red Hat:enterprise_linux:3::as
 before 14:3.7.2-7.E3.2
14:3.7.2-7.E3.2
libpcap
Red Hat:enterprise_linux:3::desktop
 before 14:0.7.2-7.E3.2
14:0.7.2-7.E3.2
tcpdump
Red Hat:enterprise_linux:3::desktop
 before 14:3.7.2-7.E3.2
14:3.7.2-7.E3.2
tcpdump-debuginfo
Red Hat:enterprise_linux:3::desktop
 before 14:3.7.2-7.E3.2
14:3.7.2-7.E3.2
Show 6 moreShow less
Affected packages
PackageAffectedFixed
libpcap
Red Hat:enterprise_linux:3::es
 before 14:0.7.2-7.E3.2
14:0.7.2-7.E3.2
tcpdump
Red Hat:enterprise_linux:3::es
 before 14:3.7.2-7.E3.2
14:3.7.2-7.E3.2
tcpdump-debuginfo
Red Hat:enterprise_linux:3::es
 before 14:3.7.2-7.E3.2
14:3.7.2-7.E3.2
libpcap
Red Hat:enterprise_linux:3::ws
 before 14:0.7.2-7.E3.2
14:0.7.2-7.E3.2
tcpdump
Red Hat:enterprise_linux:3::ws
 before 14:3.7.2-7.E3.2
14:3.7.2-7.E3.2
tcpdump-debuginfo
Red Hat:enterprise_linux:3::ws
 before 14:3.7.2-7.E3.2
14:3.7.2-7.E3.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBtcpdump - ISAKMP Identification Payload Integer Overflow2004-04-05

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2004-0184 is a medium vulnerability (CVSS 5.0) in Tcpdump, published April 6, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 60.3%, the 99th percentile. Fixed in tcpdump 3.7.2-4.

References

Show 26 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open