CVE-2017-13043
tcpdump: Buffer over-read in print-bgp.c:decode_multicast_vpn() in BGP parser
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Photon OS (alta), Red Hat (baja), Ubuntu (baja).
Descripción
The BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:decode_multicast_vpn().
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | tcpdump | 4.9.2-1 |
| debian 12 | tcpdump | 4.9.2-1 |
| debian 13 | tcpdump | 4.9.2-1 |
| debian 14 | tcpdump | 4.9.2-1 |
| debian 7 | tcpdump | 4.9.2-1~deb7u1 |
| debian 8 | tcpdump | 4.9.2-1~deb8u1 |
| debian 9 | tcpdump | 4.9.2-1~deb9u1 |
| echo | tcpdump | 4.9.2-1 |
| Photon OS 1.0 | tcpdump | 4.9.2-1.ph1 |
| Photon OS 2.0 | tcpdump | 4.9.2-1.ph2 |
| Red Hat | tcpdump | sin corrección indicada |
| seal Red Hat 6 | seal-tcpdump, tcpdump | 14:4.0.0-11.20090921gitdf3cb4.2.el6+sp999 |
Mostrar las 18 entradas de 17 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | tcpdump | 4.9.2-1 |
| debian 12 | tcpdump | 4.9.2-1 |
| debian 13 | tcpdump | 4.9.2-1 |
| debian 14 | tcpdump | 4.9.2-1 |
| debian 7 | tcpdump | 4.9.2-1~deb7u1 |
| debian 8 | tcpdump | 4.9.2-1~deb8u1 |
| debian 9 | tcpdump | 4.9.2-1~deb9u1 |
| echo | tcpdump | 4.9.2-1 |
| Photon OS 1.0 | tcpdump | 4.9.2-1.ph1 |
| Photon OS 2.0 | tcpdump | 4.9.2-1.ph2 |
| Red Hat | tcpdump | sin corrección indicada |
| seal Red Hat 6 | seal-tcpdump | 14:4.0.0-11.20090921gitdf3cb4.2.el6+sp999 |
| seal Red Hat 6 | tcpdump | 14:4.0.0-11.20090921gitdf3cb4.2.el6+sp999 |
| ubuntu 14.04 | tcpdump | 4.9.2-0ubuntu0.14.04.1 |
| ubuntu 14.04-ESM | tcpdump | 4.9.2-0ubuntu0.14.04.1 |
| ubuntu 16.04 | tcpdump | 4.9.2-0ubuntu0.16.04.1 |
| ubuntu 16.04-ESM | tcpdump | 4.9.2-0ubuntu0.16.04.1 |
| ubuntu 17.04 | tcpdump | 4.9.2-0ubuntu0.17.04.2 |
Referencias
- http://www.debian.org/security/2017/dsa-3971
- http://www.securitytracker.com/id/1039307
- http://www.tcpdump.org/tcpdump-changes.txt
- https://access.redhat.com/errata/RHEA-2018:0705
- https://access.redhat.com/security/cve/CVE-2017-13043
- https://github.com/the-tcpdump-group/tcpdump/commit/d515b4b4a300479cdf1a6e0d1bb95bc1f9fee514
- https://nvd.nist.gov/vuln/detail/CVE-2017-13043
- https://security.gentoo.org/glsa/201709-23