Cloudanix VulnDB

CVE-2015-8270

High · 7.5

CVSS

7.5

EPSS

3.2%

Published

Apr 13, 2017

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in media streaming software can make programs crash when they connect to certain servers, interrupting their normal operation.

Exploit Available
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The AMF3ReadString function in amf.c performs an invalid pointer dereference when processing a crafted AMF3 string from a remote RTMP server, resulting in a process crash.

Why it matters to the business

Affected tcpdump deployments lose availability when interacting with malicious RTMP servers, leading to operational disruptions; the issue is long-public with available exploits, increasing exposure across many environments despite the age of the flaw.

How an attack unfolds

An attacker sets up a malicious RTMP media server that returns specially crafted AMF3 data. When a vulnerable client processes the response via AMF3ReadString, the invalid pointer dereference occurs and crashes the process. Public exploit code has been available for years.

How to fix it

Upgrade affected tcpdump packages to fixed versions: 4.9.2-1 on Debian 11/12/13, 4.9.2-0ubuntu0.14.04.1 on Ubuntu 14.04 LTS, 4.9.2-0ubuntu0.16.04.1 on Ubuntu 16.04 LTS, or tcpdump GIT commit 8512734883227c11568bb35da1d48b9f8466f43f.

How to confirm the fix worked

Confirm the installed tcpdump version is at or above the listed fixed releases; reproduce the crash condition using a test RTMP server sending crafted AMF3 data and verify the process no longer terminates.

Typical attack path

  1. Attacker deploys a malicious RTMP server configured to send crafted AMF3 responses
  2. Victim client initiates an RTMP connection to the attacker-controlled server
  3. Server delivers the malformed AMF3 string during the session handshake
  4. Client crashes due to invalid pointer dereference in AMF3ReadString

How to detect it

Review system and application logs for tcpdump crashes or segmentation faults occurring during RTMP-related activity; correlate with network connections to unknown RTMP endpoints.

What your security team should do

  • Apply the listed fixed versions immediately across all tcpdump deployments
  • Inventory systems using tcpdump and prioritize those reachable by untrusted RTMP sources
  • Monitor process crash logs for tcpdump segmentation faults as a temporary detection measure

The record

The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service (invalid pointer dereference and process crash).

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 rtmpdump 0 2.4+20151223.gitfa8646d.1-1
Debian:12 rtmpdump 0 2.4+20151223.gitfa8646d.1-1
Debian:13 rtmpdump 0 2.4+20151223.gitfa8646d.1-1
Debian:14 rtmpdump 0 2.4+20151223.gitfa8646d.1-1
Debian:7 rtmpdump 0 2.4+20111222.git4e06e21-1+deb7u1
Debian:8 rtmpdump 0 2.4+20150115.gita107cef-1+deb8u1
Ubuntu:14.04:LTS rtmpdump 0 2.4+20121230.gitdf6c518-1ubuntu0.1
Ubuntu:16.04:LTS rtmpdump 0 2.4+20151223.gitfa8646d-1ubuntu0.1

Related vulnerabilities