CVE-2007-3798 Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return val...
CriticalCVSS 9.8
EPSS 70.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return value.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tcpdump | <= 3.9.6 | No fix listed |
| Canonical Ubuntu Linux | = 6.06 | No fix listed |
| Canonical Ubuntu Linux | = 6.10 | No fix listed |
| Canonical Ubuntu Linux | = 7.04 | No fix listed |
| debian linux | = 3.1 | No fix listed |
| debian linux | = 4.0 | No fix listed |
| slackware | = 9.0 | No fix listed |
| slackware | = 9.1 | No fix listed |
| slackware | = 10.0 | No fix listed |
| slackware | = 10.1 | No fix listed |
| slackware | = 10.2 | No fix listed |
| slackware | = 11.0 | No fix listed |
| slackware | = 12.0 | No fix listed |
| freebsd | >= 5.0, < 5.5 | 5.5 |
| freebsd | >= 6.0, < 6.1 | 6.1 |
| freebsd | = 5.5 | No fix listed |
| freebsd | = 5.5-p1 | No fix listed |
| freebsd | = 5.5-p11 | No fix listed |
| freebsd | = 5.5-p12 | No fix listed |
| freebsd | = 5.5-p13 | No fix listed |
| freebsd | = 5.5-p14 | No fix listed |
| freebsd | = 5.5-p2 | No fix listed |
| freebsd | = 5.5-p3 | No fix listed |
| freebsd | = 5.5-p4 | No fix listed |
| freebsd | = 5.5-p5 | No fix listed |
Show 27 more
| Product | Affected versions | Fixed in |
|---|---|---|
| freebsd | = 5.5-p7 | No fix listed |
| freebsd | = 5.5-p8 | No fix listed |
| freebsd | = 5.5-p9 | No fix listed |
| freebsd | = 6.1 | No fix listed |
| freebsd | = 6.1-p1 | No fix listed |
| freebsd | = 6.1-p10 | No fix listed |
| freebsd | = 6.1-p11 | No fix listed |
| freebsd | = 6.1-p12 | No fix listed |
| freebsd | = 6.1-p13 | No fix listed |
| freebsd | = 6.1-p16 | No fix listed |
| freebsd | = 6.1-p17 | No fix listed |
| freebsd | = 6.1-p18 | No fix listed |
| freebsd | = 6.1-p2 | No fix listed |
| freebsd | = 6.1-p4 | No fix listed |
| freebsd | = 6.1-p6 | No fix listed |
| freebsd | = 6.1-p7 | No fix listed |
| freebsd | = 6.1-p9 | No fix listed |
| freebsd | = 6.2 | No fix listed |
| freebsd | = 6.2-p1 | No fix listed |
| freebsd | = 6.2-p4 | No fix listed |
| freebsd | = 6.2-p5 | No fix listed |
| freebsd | = 6.2-p6 | No fix listed |
| apple mac os x | >= 10.0.0, < 10.4.11 | 10.4.11 |
| apple mac os x server | >= 10.0.0, < 10.4.11 | 10.4.11 |
| debian/tcpdump(Debian:12) | < 3.9.5-3 | 3.9.5-3 |
| debian/tcpdump(Debian:13) | < 3.9.5-3 | 3.9.5-3 |
| debian/tcpdump(Debian:14) | < 3.9.5-3 | 3.9.5-3 |
References
- Debian Security Tracker CVE-2007-3798 vendor-advisory
- bugs.debian.org issue-tracking
- bugs.gentoo.org third-party-advisory
- cvs.tcpdump.org broken-link
- docs.info.apple.com broken-link
- APPLE-SA-2007-12-17 mailing-list vendor-advisory
- 26135 broken-link third-party-advisory vendor-advisory
- 26168 broken-link third-party-advisory vendor-advisory
- 26223 broken-link third-party-advisory vendor-advisory
- 26231 broken-link third-party-advisory vendor-advisory
- 26263 broken-link third-party-advisory vendor-advisory
- 26266 broken-link third-party-advisory vendor-advisory
- 26286 broken-link third-party-advisory vendor-advisory
- 26395 broken-link third-party-advisory vendor-advisory
- 26404 broken-link third-party-advisory vendor-advisory
- 26521 broken-link third-party-advisory vendor-advisory
- 27580 broken-link third-party-advisory vendor-advisory
- 28136 broken-link third-party-advisory vendor-advisory
- FreeBSD-SA-07:06 third-party-advisory vendor-advisory
- GLSA-200707-14 third-party-advisory vendor-advisory
- SSA:2007-230-01 mailing-list patch vendor-advisory
- DSA-1353 third-party-advisory vendor-advisory
- www.digit-labs.org exploit
- MDKSA-2007:148 third-party-advisory vendor-advisory
- SUSE-SR:2007:016 broken-link vendor-advisory
- RHSA-2007:0368 broken-link vendor-advisory
- RHSA-2007:0387 broken-link vendor-advisory
- 20070720 rPSA-2007-0147-1 tcpdump broken-link mailing-list third-party-advisory vdb-entry
- 24965 broken-link third-party-advisory vdb-entry
- 1018434 broken-link third-party-advisory vdb-entry
- 2007-0023 broken-link vendor-advisory
- TLSA-2007-46 broken-link vendor-advisory
- USN-492-1 third-party-advisory vendor-advisory
- TA07-352A broken-link third-party-advisory us-government-resource
- ADV-2007-2578 broken-link vdb-entry vendor-advisory
- ADV-2007-4238 broken-link vdb-entry vendor-advisory
- oval:org.mitre.oval:def:9771 broken-link signature vdb-entry