CVE-2017-11108

What it actually does

Remote attacker can trigger a heap-based buffer over-read in the EXTRACT_16BITS function called from stp_print during Spanning Tree Protocol packet parsing, resulting in application crash.

Why it matters to the business

Service disruption and potential loss of network monitoring capability across environments with 98 downstream dependents; urgency is low given stable low EPSS, lack of KEV listing, and absence of known exploitation after many years.

How an attack unfolds

An unauthenticated remote attacker crafts a malicious STP packet that triggers an out-of-bounds read when tcpdump processes the packet; the malformed data reaches EXTRACT_16BITS and forces a crash without requiring authentication or user interaction.

How to fix it

Upgrade tensorflow (Bitnami) to version 2.1.4 or later; ensure any bundled tcpdump components are updated to versions beyond 4.9.0 that contain the corrected STP parsing logic.

How to confirm the fix worked

Confirm the installed package version matches or exceeds the fixed release; test STP packet parsing with known-good and boundary-case traffic to verify absence of crash.

Typical attack path

1. Identify a target running an affected version of the network analysis component
2. Craft a malicious STP packet that reaches the vulnerable parsing path
3. Transmit the packet to a network interface monitored by the affected software
4. Trigger the buffer over-read and application crash

How to detect it

Search packet capture or application logs for STP protocol processing around the time of unexpected crashes; look for repeated crashes of the tcpdump or dependent process when handling STP frames.

What your security team should do

• Apply the listed fixed version immediately in all affected tensorflow (Bitnami) deployments
• Review network monitoring pipelines for exposure to untrusted STP traffic
• Monitor EPSS and KEV updates for any change in exploitation likelihood