CVE-2007-3798
Critical · 9.8CVSS
9.8
EPSS
70.4%
Published
Jul 16, 2007
CISA due date
—
The record
Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return value.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | tcpdump | 0 | 3.9.5-3 |
| Debian:12 | tcpdump | 0 | 3.9.5-3 |
| Debian:13 | tcpdump | 0 | 3.9.5-3 |
| Debian:3.1 | tcpdump | 0 | 3.8.3-5sarge3 |
| Debian:4.0 | tcpdump | 0 | 3.9.5-2etch1 |
| Red Hat:enterprise_linux:4::as | arpwatch | 0 | 14:2.1a13-12.el4 |
| Red Hat:enterprise_linux:4::as | libpcap | 0 | 14:0.8.3-12.el4 |
| Red Hat:enterprise_linux:4::as | tcpdump | 0 | 14:3.8.2-12.el4 |
| Red Hat:enterprise_linux:4::as | tcpdump-debuginfo | 0 | 14:3.8.2-12.el4 |
| Red Hat:enterprise_linux:4::desktop | arpwatch | 0 | 14:2.1a13-12.el4 |
| Red Hat:enterprise_linux:4::desktop | libpcap | 0 | 14:0.8.3-12.el4 |
| Red Hat:enterprise_linux:4::desktop | tcpdump | 0 | 14:3.8.2-12.el4 |
| Red Hat:enterprise_linux:4::desktop | tcpdump-debuginfo | 0 | 14:3.8.2-12.el4 |
| Red Hat:enterprise_linux:4::es | arpwatch | 0 | 14:2.1a13-12.el4 |
| Red Hat:enterprise_linux:4::es | libpcap | 0 | 14:0.8.3-12.el4 |
| Red Hat:enterprise_linux:4::es | tcpdump | 0 | 14:3.8.2-12.el4 |
| Red Hat:enterprise_linux:4::es | tcpdump-debuginfo | 0 | 14:3.8.2-12.el4 |
| Red Hat:enterprise_linux:4::ws | arpwatch | 0 | 14:2.1a13-12.el4 |
| Red Hat:enterprise_linux:4::ws | libpcap | 0 | 14:0.8.3-12.el4 |
| Red Hat:enterprise_linux:4::ws | tcpdump | 0 | 14:3.8.2-12.el4 |
| Red Hat:enterprise_linux:4::ws | tcpdump-debuginfo | 0 | 14:3.8.2-12.el4 |
| Red Hat:enterprise_linux:5::client | arpwatch | 0 | 14:2.1a13-18.el5 |
| Red Hat:enterprise_linux:5::client | libpcap | 0 | 14:0.9.4-11.el5 |
| Red Hat:enterprise_linux:5::client | libpcap-devel | 0 | 14:0.9.4-11.el5 |
| Red Hat:enterprise_linux:5::client | tcpdump | 0 | 14:3.9.4-11.el5 |
| Red Hat:enterprise_linux:5::client | tcpdump-debuginfo | 0 | 14:3.9.4-11.el5 |
| Red Hat:enterprise_linux:5::client_workstation | arpwatch | 0 | 14:2.1a13-18.el5 |
| Red Hat:enterprise_linux:5::client_workstation | libpcap | 0 | 14:0.9.4-11.el5 |
| Red Hat:enterprise_linux:5::client_workstation | libpcap-devel | 0 | 14:0.9.4-11.el5 |
| Red Hat:enterprise_linux:5::client_workstation | tcpdump | 0 | 14:3.9.4-11.el5 |
| Red Hat:enterprise_linux:5::client_workstation | tcpdump-debuginfo | 0 | 14:3.9.4-11.el5 |
| Red Hat:enterprise_linux:5::server | arpwatch | 0 | 14:2.1a13-18.el5 |
| Red Hat:enterprise_linux:5::server | libpcap | 0 | 14:0.9.4-11.el5 |
| Red Hat:enterprise_linux:5::server | libpcap-devel | 0 | 14:0.9.4-11.el5 |
| Red Hat:enterprise_linux:5::server | tcpdump | 0 | 14:3.9.4-11.el5 |
| Red Hat:enterprise_linux:5::server | tcpdump-debuginfo | 0 | 14:3.9.4-11.el5 |
Related vulnerabilities
- CVE-2017-16808 tcpdump before 4.9.3 has a heap-based buffer over-read related to aoe_print in… Also affects tcpdump
- CVE-2017-11108 tcpdump 4.9.0 allows remote attackers to cause a denial of service (heap-based buffer… Also affects tcpdump
- CVE-2016-7922 The AH parser in tcpdump before 4.9.0 has a buffer overflow in print-ah.c:ah_print(). Also affects tcpdump
- CVE-2015-2153 The rpki_rtr_pdu_print function in print-rpki-rtr.c in the TCP printer in tcpdump before… Also affects tcpdump
- CVE-2015-0261 Integer signedness error in the mobility_opt_print function in the IPv6 mobility printer… Also affects tcpdump
- CVE-2014-8768 Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2… Also affects tcpdump
- CVE-2014-8767 Integer underflow in the olsr_print function in tcpdump 3.9.6 through 4.6.2, when in… Also affects tcpdump
- CVE-2005-1267 The bgp_update_print function in tcpdump 3.x does not properly handle a -1 return value… Also affects tcpdump