CVE-2018-14463

The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 2, a different vulnerability than CVE-2019-15167.

The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 2, a different vulnerability than CVE-2019-15167.

The tcpdump packages contain the tcpdump utility for monitoring network traffic. The tcpdump utility can capture and display the packet headers on a particular network interface or on all interfaces.

The following packages have been upgraded to a later upstream version: tcpdump (4.9.3). (BZ#1804063)

Security Fix(es):

• tcpdump: SMB data printing mishandled (CVE-2018-10103)

• tcpdump: SMB data printing mishandled (CVE-2018-10105)

• tcpdump: Out of bounds read/write in get_next_file() in tcpdump.c (CVE-2018-14879)

• tcpdump: Buffer over-read in ldp_tlv_print() function in print-ldp.c (CVE-2018-14461)

• tcpdump: Buffer over-read in icmp_print() function in print-icmp.c (CVE-2018-14462)

• tcpdump: Buffer over-read in vrrp_print() function in print-vrrp.c (CVE-2018-14463)

• tcpdump: Buffer over-read in lmp_print_data_link_subobjs() function in print-lmp.c (CVE-2018-14464)

• tcpdump: Buffer over-read in rsvp_obj_print() function in print-rsvp.c (CVE-2018-14465)

• tcpdump: Buffer over-read in print-icmp6.c (CVE-2018-14466)

• tcpdump: Buffer over-read in bgp_capabilities_print() in print-bgp.c (CVE-2018-14467)

• tcpdump: Buffer over-read in mfr_print() function in print-fr.c (CVE-2018-14468)

• tcpdump: Buffer over-read in ikev1_n_print() function in print-isakmp.c (CVE-2018-14469)

• tcpdump: Buffer over-read in babel_print_v2() in print-babel.c (CVE-2018-14470)

• tcpdump: Buffer over-read in ospf6_print_lshdr() function in print-ospf6.c (CVE-2018-14880)

• tcpdump: Buffer over-read in bgp_capabilities_print() function in print-bgp.c (CVE-2018-14881)

• tcpdump: Buffer over-read in function rpl_dio_printopt in print-icmp6.c (CVE-2018-14882)

• tcpdump: Buffer over-read in print-802_11.c (CVE-2018-16227)

• tcpdump: Access to uninitialized buffer in print_prefix() function in print-hncp.c (CVE-2018-16228)

• tcpdump: Buffer over-read in dccp_print_option() function in print-dccp.c (CVE-2018-16229)

• tcpdump: Buffer over-read in bgp_attr_print() function in print-bgp.c (CVE-2018-16230)

• tcpdump: Resource exhaustion in bgp_attr_print() function in print-bgp.c (CVE-2018-16300)

• tcpdump: Buffer over-read in print_trans() function in print-smb.c (CVE-2018-16451)

• tcpdump: Resource exhaustion in smb_fdata() funtion in smbutil.c (CVE-2018-16452)

• tcpdump: Buffer overflow in lmp_print_data_link_subobjs() in print-lmp.c (CVE-2019-15166)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.

The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 2, a different vulnerability than CVE-2019-15167.

Updated libpcap and tcpdump packages fix security vulnerabilities:

The libpcap packages have been updated to versions 1.9.1 and tcpdump to 4.9.3, respectively, fixing several buffer overread and overflow issues.

This update for tcpdump fixes the following issues:

• CVE-2017-16808: Fixed a heap-based buffer over-read related to aoe_print and lookup_emem (bsc#1068716 bsc#1153098).
• CVE-2018-10103: Fixed a mishandling of the printing of SMB data (bsc#1153098).
• CVE-2018-10105: Fixed a mishandling of the printing of SMB data (bsc#1153098).
• CVE-2018-14461: Fixed a buffer over-read in print-ldp.c:ldp_tlv_print (bsc#1153098).
• CVE-2018-14462: Fixed a buffer over-read in print-icmp.c:icmp_print (bsc#1153098).
• CVE-2018-14463: Fixed a buffer over-read in print-vrrp.c:vrrp_print (bsc#1153098).
• CVE-2018-14464: Fixed a buffer over-read in print-lmp.c:lmp_print_data_link_subobjs (bsc#1153098).
• CVE-2018-14465: Fixed a buffer over-read in print-rsvp.c:rsvp_obj_print (bsc#1153098).
• CVE-2018-14466: Fixed a buffer over-read in print-rx.c:rx_cache_find (bsc#1153098).
• CVE-2018-14467: Fixed a buffer over-read in print-bgp.c:bgp_capabilities_print (bsc#1153098).
• CVE-2018-14468: Fixed a buffer over-read in print-fr.c:mfr_print (bsc#1153098).
• CVE-2018-14469: Fixed a buffer over-read in print-isakmp.c:ikev1_n_print (bsc#1153098).
• CVE-2018-14470: Fixed a buffer over-read in print-babel.c:babel_print_v2 (bsc#1153098).
• CVE-2018-14879: Fixed a buffer overflow in the command-line argument parser (bsc#1153098).
• CVE-2018-14880: Fixed a buffer over-read in the OSPFv3 parser (bsc#1153098).
• CVE-2018-14881: Fixed a buffer over-read in the BGP parser (bsc#1153098).
• CVE-2018-14882: Fixed a buffer over-read in the ICMPv6 parser (bsc#1153098).
• CVE-2018-16227: Fixed a buffer over-read in the IEEE 802.11 parser in print-802_11.c for the Mesh Flags subfield (bsc#1153098).
• CVE-2018-16228: Fixed a buffer over-read in the HNCP parser (bsc#1153098).
• CVE-2018-16229: Fixed a buffer over-read in the DCCP parser (bsc#1153098).
• CVE-2018-16230: Fixed a buffer over-read in the BGP parser in print-bgp.c:bgp_attr_print (bsc#1153098).
• CVE-2018-16300: Fixed an unlimited recursion in the BGP parser that allowed denial-of-service by stack consumption (bsc#1153098).
• CVE-2018-16301: Fixed a buffer overflow (bsc#1153332 bsc#1153098).
• CVE-2018-16451: Fixed several buffer over-reads in print-smb.c:print_trans() for \MAILSLOT\BROWSE and \PIPE\LANMAN (bsc#1153098).
• CVE-2018-16452: Fixed a stack exhaustion in smbutil.c:smb_fdata (bsc#1153098).
• CVE-2019-15166: Fixed a bounds check in lmp_print_data_link_subobjs (bsc#1153098).
• CVE-2019-15167: Fixed a vulnerability in VRRP (bsc#1153098).

This update was imported from the SUSE:SLE-15:Update update project.

This update for tcpdump fixes the following issues:

• CVE-2017-16808: Fixed a heap-based buffer over-read related to aoe_print and lookup_emem (bsc#1068716 bsc#1153098).
• CVE-2018-10103: Fixed a mishandling of the printing of SMB data (bsc#1153098).
• CVE-2018-10105: Fixed a mishandling of the printing of SMB data (bsc#1153098).
• CVE-2018-14461: Fixed a buffer over-read in print-ldp.c:ldp_tlv_print (bsc#1153098).
• CVE-2018-14462: Fixed a buffer over-read in print-icmp.c:icmp_print (bsc#1153098).
• CVE-2018-14463: Fixed a buffer over-read in print-vrrp.c:vrrp_print (bsc#1153098).
• CVE-2018-14464: Fixed a buffer over-read in print-lmp.c:lmp_print_data_link_subobjs (bsc#1153098).
• CVE-2018-14465: Fixed a buffer over-read in print-rsvp.c:rsvp_obj_print (bsc#1153098).
• CVE-2018-14466: Fixed a buffer over-read in print-rx.c:rx_cache_find (bsc#1153098).
• CVE-2018-14467: Fixed a buffer over-read in print-bgp.c:bgp_capabilities_print (bsc#1153098).
• CVE-2018-14468: Fixed a buffer over-read in print-fr.c:mfr_print (bsc#1153098).
• CVE-2018-14469: Fixed a buffer over-read in print-isakmp.c:ikev1_n_print (bsc#1153098).
• CVE-2018-14470: Fixed a buffer over-read in print-babel.c:babel_print_v2 (bsc#1153098).
• CVE-2018-14879: Fixed a buffer overflow in the command-line argument parser (bsc#1153098).
• CVE-2018-14880: Fixed a buffer over-read in the OSPFv3 parser (bsc#1153098).
• CVE-2018-14881: Fixed a buffer over-read in the BGP parser (bsc#1153098).
• CVE-2018-14882: Fixed a buffer over-read in the ICMPv6 parser (bsc#1153098).
• CVE-2018-16227: Fixed a buffer over-read in the IEEE 802.11 parser in print-802_11.c for the Mesh Flags subfield (bsc#1153098).
• CVE-2018-16228: Fixed a buffer over-read in the HNCP parser (bsc#1153098).
• CVE-2018-16229: Fixed a buffer over-read in the DCCP parser (bsc#1153098).
• CVE-2018-16230: Fixed a buffer over-read in the BGP parser in print-bgp.c:bgp_attr_print (bsc#1153098).
• CVE-2018-16300: Fixed an unlimited recursion in the BGP parser that allowed denial-of-service by stack consumption (bsc#1153098).
• CVE-2018-16301: Fixed a buffer overflow (bsc#1153332 bsc#1153098).
• CVE-2018-16451: Fixed several buffer over-reads in print-smb.c:print_trans() for \MAILSLOT\BROWSE and \PIPE\LANMAN (bsc#1153098).
• CVE-2018-16452: Fixed a stack exhaustion in smbutil.c:smb_fdata (bsc#1153098).
• CVE-2019-15166: Fixed a bounds check in lmp_print_data_link_subobjs (bsc#1153098).
• CVE-2019-15167: Fixed a vulnerability in VRRP (bsc#1153098).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the tcpdump-4.99.1-1.2 package on the GA media of openSUSE Tumbleweed.

This update for tcpdump fixes the following issues:

Security issues fixed:

• CVE-2017-12995: Fixed an infinite loop in the DNS parser that allowed remote DoS (bsc#1057247).
• CVE-2017-12893: Fixed a buffer over-read in the SMB/CIFS parser that allowed remote DoS (bsc#1057247).
• CVE-2017-12894: Fixed a buffer over-read in several protocol parsers that allowed remote DoS (bsc#1057247).
• CVE-2017-12896: Fixed a buffer over-read in the ISAKMP parser that allowed remote DoS (bsc#1057247).
• CVE-2017-12897: Fixed a buffer over-read in the ISO CLNS parser that allowed remote DoS (bsc#1057247).
• CVE-2017-12898: Fixed a buffer over-read in the NFS parser that allowed remote DoS (bsc#1057247).
• CVE-2017-12899: Fixed a buffer over-read in the DECnet parser that allowed remote DoS (bsc#1057247).
• CVE-2017-12900: Fixed a buffer over-read in the in several protocol parsers that allowed remote DoS (bsc#1057247).
• CVE-2017-12901: Fixed a buffer over-read in the EIGRP parser that allowed remote DoS (bsc#1057247).
• CVE-2017-12902: Fixed a buffer over-read in the Zephyr parser that allowed remote DoS (bsc#1057247).
• CVE-2017-12985: Fixed a buffer over-read in the IPv6 parser that allowed remote DoS (bsc#1057247).
• CVE-2017-12986: Fixed a buffer over-read in the IPv6 routing header parser that allowed remote DoS (bsc#1057247).
• CVE-2017-12987: Fixed a buffer over-read in the 802.11 parser that allowed remote DoS (bsc#1057247).
• CVE-2017-12988: Fixed a buffer over-read in the telnet parser that allowed remote DoS (bsc#1057247).
• CVE-2017-12991: Fixed a buffer over-read in the BGP parser that allowed remote DoS (bsc#1057247).
• CVE-2017-12992: Fixed a buffer over-read in the RIPng parser that allowed remote DoS (bsc#1057247).
• CVE-2017-12993: Fixed a buffer over-read in the Juniper protocols parser that allowed remote DoS (bsc#1057247).
• CVE-2017-12996: Fixed a buffer over-read in the PIMv2 parser that allowed remote DoS (bsc#1057247).
• CVE-2017-12998: Fixed a buffer over-read in the IS-IS parser that allowed remote DoS (bsc#1057247).
• CVE-2017-12999: Fixed a buffer over-read in the IS-IS parser that allowed remote DoS (bsc#1057247).
• CVE-2017-13001: Fixed a buffer over-read in the NFS parser that allowed remote DoS (bsc#1057247).
• CVE-2017-13002: Fixed a buffer over-read in the AODV parser that allowed remote DoS (bsc#1057247).
• CVE-2017-13003: Fixed a buffer over-read in the LMP parser that allowed remote DoS (bsc#1057247).
• CVE-2017-13004: Fixed a buffer over-read in the Juniper protocols parser that allowed remote DoS (bsc#1057247).
• CVE-2017-13005: Fixed a buffer over-read in the NFS parser that allowed remote DoS (bsc#1057247).
• CVE-2017-13006: Fixed a buffer over-read in the L2TP parser that allowed remote DoS (bsc#1057247).
• CVE-2017-13008: Fixed a buffer over-read in the IEEE 802.11 parser that allowed remote DoS (bsc#1057247).
• CVE-2017-13009: Fixed a buffer over-read in the IPv6 mobility parser that allowed remote DoS (bsc#1057247).
• CVE-2017-13010: Fixed a buffer over-read in the BEEP parser that allowed remote DoS (bsc#1057247).
• CVE-2017-13012: Fixed a buffer over-read in the ICMP parser that allowed remote DoS (bsc#1057247).
• CVE-2017-13013: Fixed a buffer over-read in the ARP parser that allowed remote DoS (bsc#1057247).
• CVE-2017-13014: Fixed a buffer over-read in the White Board protocol parser that allowed remote DoS (bsc#1057247).
• CVE-2017-13016: Fixed a buffer over-read in the ISO ES-IS parser that allowed remote DoS (bsc#1057247).
• CVE-2017-13017: Fixed a buffer over-read in the DHCPv6 parser that allowed remote DoS (bsc#1057247).
• CVE-2017-13018: Fixed a buffer over-read in the PGM parser that allowed remote DoS (bsc#1057247).
• CVE-2017-13019: Fixed a buffer over-read in the PGM parser that allowed remote DoS (bsc#1057247).
• CVE-2017-13021: Fixed a buffer over-read in the ICMPv6 parser that allowed remote DoS (bsc#1057247).
• CVE-2017-13022: Fixed a buffer over-read in the IP parser that…

This update for tcpdump fixes the following issues:

• CVE-2017-16808: Fixed a heap-based buffer over-read related to aoe_print and lookup_emem (bsc#1068716 bsc#1153098).
• CVE-2018-10103: Fixed a mishandling of the printing of SMB data (bsc#1153098).
• CVE-2018-10105: Fixed a mishandling of the printing of SMB data (bsc#1153098).
• CVE-2018-14461: Fixed a buffer over-read in print-ldp.c:ldp_tlv_print (bsc#1153098).
• CVE-2018-14462: Fixed a buffer over-read in print-icmp.c:icmp_print (bsc#1153098).
• CVE-2018-14463: Fixed a buffer over-read in print-vrrp.c:vrrp_print (bsc#1153098).
• CVE-2018-14464: Fixed a buffer over-read in print-lmp.c:lmp_print_data_link_subobjs (bsc#1153098).
• CVE-2018-14465: Fixed a buffer over-read in print-rsvp.c:rsvp_obj_print (bsc#1153098).
• CVE-2018-14466: Fixed a buffer over-read in print-rx.c:rx_cache_find (bsc#1153098).
• CVE-2018-14467: Fixed a buffer over-read in print-bgp.c:bgp_capabilities_print (bsc#1153098).
• CVE-2018-14468: Fixed a buffer over-read in print-fr.c:mfr_print (bsc#1153098).
• CVE-2018-14469: Fixed a buffer over-read in print-isakmp.c:ikev1_n_print (bsc#1153098).
• CVE-2018-14470: Fixed a buffer over-read in print-babel.c:babel_print_v2 (bsc#1153098).
• CVE-2018-14879: Fixed a buffer overflow in the command-line argument parser (bsc#1153098).
• CVE-2018-14880: Fixed a buffer over-read in the OSPFv3 parser (bsc#1153098).
• CVE-2018-14881: Fixed a buffer over-read in the BGP parser (bsc#1153098).
• CVE-2018-14882: Fixed a buffer over-read in the ICMPv6 parser (bsc#1153098).
• CVE-2018-16227: Fixed a buffer over-read in the IEEE 802.11 parser in print-802_11.c for the Mesh Flags subfield (bsc#1153098).
• CVE-2018-16228: Fixed a buffer over-read in the HNCP parser (bsc#1153098).
• CVE-2018-16229: Fixed a buffer over-read in the DCCP parser (bsc#1153098).
• CVE-2018-16230: Fixed a buffer over-read in the BGP parser in print-bgp.c:bgp_attr_print (bsc#1153098).
• CVE-2018-16300: Fixed an unlimited recursion in the BGP parser that allowed denial-of-service by stack consumption (bsc#1153098).
• CVE-2018-16301: Fixed a buffer overflow (bsc#1153332 bsc#1153098).
• CVE-2018-16451: Fixed several buffer over-reads in print-smb.c:print_trans() for \MAILSLOT\BROWSE and \PIPE\LANMAN (bsc#1153098).
• CVE-2018-16452: Fixed a stack exhaustion in smbutil.c:smb_fdata (bsc#1153098).
• CVE-2019-15166: Fixed a bounds check in lmp_print_data_link_subobjs (bsc#1153098).
• CVE-2019-15167: Fixed a vulnerability in VRRP (bsc#1153098).

This update for tcpdump fixes the following issues:

• CVE-2020-8037: Fixed an issue where PPP decapsulator did not allocate the right buffer size (bsc#1178466).

The previous update of tcpdump already fixed variuous Buffer overflow/overread vulnerabilities [bsc#1153098, bsc#1153332]

• CVE-2017-16808 (AoE)
• CVE-2018-14468 (FrameRelay)
• CVE-2018-14469 (IKEv1)
• CVE-2018-14470 (BABEL)
• CVE-2018-14466 (AFS/RX)
• CVE-2018-14461 (LDP)
• CVE-2018-14462 (ICMP)
• CVE-2018-14465 (RSVP)
• CVE-2018-14464 (LMP)
• CVE-2019-15166 (LMP)
• CVE-2018-14880 (OSPF6)
• CVE-2018-14882 (RPL)
• CVE-2018-16227 (802.11)
• CVE-2018-16229 (DCCP)
• CVE-2018-14467 (BGP)
• CVE-2018-14881 (BGP)
• CVE-2018-16230 (BGP)
• CVE-2018-16300 (BGP)
• CVE-2018-14463 (VRRP)
• CVE-2019-15167 (VRRP)
• CVE-2018-14879 (tcpdump -V)
• CVE-2018-16228 (HNCP) is a duplicate of the already fixed CVE-2019-1010220
• CVE-2018-16301 (fixed in libpcap)
• CVE-2018-16451 (SMB)
• CVE-2018-16452 (SMB)
• CVE-2018-10103 (SMB - partially fixed, but SMB printing disabled)
• CVE-2018-10105 (SMB - too unreliably reproduced, SMB printing disabled)

Multiple security issues were discovered in tcpdump. A remote attacker could use these issues to cause tcpdump to crash, resulting in a denial of service, or possibly execute arbitrary code.

USN-4252-1 fixed several vulnerabilities in tcpdump. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

Multiple security issues were discovered in tcpdump. A remote attacker could use these issues to cause tcpdump to crash, resulting in a denial of service, or possibly execute arbitrary code.