CVE-2017-16808

Current Description

tcpdump before 4.9.3 has a heap-based buffer over-read related to aoe_print in print-aoe.c and lookup_emem in addrtoname.c.

Basic Data

PublishedNovember 13, 2017
Last ModifiedOctober 02, 2019
Assignercve@mitre.org
Data TypeCVE
Data FormatMITRE
Data Version4.0
Problem TypeCWE-125
CVE Data Version4.0

Base Metric V2

CVSS 2 - Version2.0
CVSS 2 - Vector StringAV:N/AC:M/Au:N/C:N/I:N/A:P
CVSS 2 - Access VectorNETWORK
CVSS 2 - Access ComplexityMEDIUM
CVSS 2 - AuthenticationNONE
CVSS 2 - Confidentiality ImpactNONE
CVSS 2 - Availability ImpactPARTIAL
CVSS 2 - Base Score4.3
SeverityMEDIUM
Exploitability Score8.6
Impact Score2.9
Obtain All Privilegefalse
Obtain User Privilegefalse
Obtain Other Privilegefalse

Base Metric V3

CVSS 3 - Version3.0
CVSS 3 - Vector StringCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 3 - Attack VectorLOCAL
CVSS 3 - Attack ComplexityLOW
CVSS 3 - Privileges RequiredNONE
CVSS 3 - User InteractionREQUIRED
CVSS 3 - ScopeUNCHANGED
CVSS 3 - Confidentiality ImpactNONE
CVSS 3 - Integrity ImpactNONE
CVSS 3 - Availability ImpactHIGH
CVSS 3 - Base Score5.5
CVSS 3 - Base SeverityMEDIUM
Exploitability Score1.8
Base SeverityMEDIUM

Configurations

  • OR - Configuration 1
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3ApplicationTcpdumpTcpdump4.9.2*******

Vulnerable Software List

VendorProductVersions
Tcpdump Tcpdump 4.9.2

References

NameSourceURLTags
openSUSE-SU-2019:1964http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00065.htmlSUSE
openSUSE-SU-2019:2344http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.htmlSUSE
openSUSE-SU-2019:2348http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.htmlSUSE
http://packetstormsecurity.com/files/154710/Slackware-Security-Advisory-tcpdump-Updates.htmlhttp://packetstormsecurity.com/files/154710/Slackware-Security-Advisory-tcpdump-Updates.htmlMISC
20191213 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierrahttp://seclists.org/fulldisclosure/2019/Dec/26FULLDISC
1039773http://www.securitytracker.com/id/1039773SECTRACKThird Party Advisory VDB Entry
https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGEShttps://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGESMISC
https://github.com/the-tcpdump-group/tcpdump/issues/645https://github.com/the-tcpdump-group/tcpdump/issues/645CONFIRMThird Party Advisory
FEDORA-2019-6db0d5b9d9https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62XY4FEDORA
FEDORA-2019-d06bc63433https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNYXFFEDORA
FEDORA-2019-85d92df70fhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R2UDPFEDORA
20191211 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierrahttps://seclists.org/bugtraq/2019/Dec/23BUGTRAQ
20191002 [slackware-security] tcpdump (SSA:2019-274-01)https://seclists.org/bugtraq/2019/Oct/2BUGTRAQ
https://support.apple.com/kb/HT210788https://support.apple.com/kb/HT210788CONFIRM
USN-4252-1https://usn.ubuntu.com/4252-1/UBUNTU
USN-4252-2https://usn.ubuntu.com/4252-2/UBUNTU