CVE-2016-7922

What it actually does

Buffer overflow in the AH parser (print-ah.c:ah_print) allows memory corruption when processing malformed network packets.

Why it matters to the business

Remote attackers may crash the packet capture process or execute arbitrary code on systems running vulnerable network analysis tools, disrupting monitoring and potentially leading to broader system compromise in environments reliant on traffic inspection.

How an attack unfolds

An attacker sends crafted network packets containing oversized or malformed Authentication Header data to a network segment where tcpdump is actively capturing traffic; the parser overflows a buffer during decoding, enabling memory corruption that can be leveraged for code execution.

How to fix it

Upgrade tcpdump to version 4.9.0 or later on all affected systems; apply vendor patches promptly given the high severity and remote exploitability.

How to confirm the fix worked

Run 'tcpdump --version' to confirm the installed version is 4.9.0 or newer; test parsing of sample AH packets in a controlled environment to verify stability.

Typical attack path

1. Craft malicious network packets with malformed AH headers
2. Transmit packets to the monitored network segment
3. tcpdump processes the packets during live capture
4. Buffer overflow occurs in the AH parser
5. Memory corruption leads to denial of service or arbitrary code execution

How to detect it

Monitor system and application logs for unexpected tcpdump process crashes or segmentation faults during packet capture; review network traffic captures for repeated malformed AH packets around the time of any incidents.

What your security team should do

• Upgrade tcpdump to 4.9.0 or newer across the environment immediately
• Restrict tcpdump usage to trusted networks only until patched
• Review and update network monitoring tools to current supported releases