CVE-2018-16228

Name of the Vulnerable Software and Affected Versions tcpdump versions prior to 4.9.3

Description The issue is related to a buffer over-read in the HNCP parser of the tcpdump utility, specifically in the print-hncp.c:print prefix() function. This can be exploited by a remote attacker to cause a denial of service. The vulnerability is also related to a heap-based buffer over-read in the aoe print function in print-aoe.c and the lookup emem function in addrtoname.c.

Recommendations For versions prior to 4.9.3, update to version 4.9.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the HNCP parser and the affected functions until a patch is available. Avoid using the print-hncp.c:print prefix() function and the aoe print function in print-aoe.c until the issue is resolved. Restrict access to the lookup emem function in addrtoname.c to minimize the risk of exploitation.