CVE-2014-8767

What it actually does

Integer underflow in olsr_print during verbose-mode OLSR frame parsing leads to invalid memory access and process crash.

Why it matters to the business

Disrupts network diagnostics and monitoring workflows that rely on tcpdump, increasing time to resolve connectivity or security incidents on affected systems.

How an attack unfolds

An attacker sends a single crafted OLSR packet containing a malicious length field; when tcpdump processes the frame in verbose mode the underflow occurs and the tool terminates.

How to fix it

Upgrade tcpdump to a version newer than 4.6.2 on all Red Hat and openSUSE systems; if immediate upgrade is impossible, avoid verbose mode on untrusted interfaces.

How to confirm the fix worked

Confirm tcpdump version exceeds 4.6.2, then replay a known-bad OLSR frame while monitoring for continued operation instead of a crash.

Typical attack path

1. Locate hosts running tcpdump with -v or -vv flags on networks carrying OLSR traffic
2. Craft an OLSR frame whose length value triggers the underflow
3. Transmit the frame to the listening interface
4. Observe tcpdump crash and loss of capture session

How to detect it

Review system and application logs for tcpdump segmentation faults or aborts while OLSR traffic was being processed; correlate with network captures containing OLSR frames.

• olsr_print
• tcpdump.*segmentation fault
• tcpdump.*abort

What your security team should do

• Prioritize patching tcpdump across all monitored hosts
• Restrict use of verbose tcpdump to trusted networks only
• Add tcpdump crash signatures to monitoring dashboards