CVE-2019-1010220

Name of the Vulnerable Software and Affected Versions tcpdump version 4.9.2

Description The issue is caused by a buffer over-read, which may expose sensitive information such as the Saved Frame Pointer and Return Address on the stack. This occurs in the print prefix function, specifically at line 234 in the "print-hncp.c" component, where the code ND PRINT((ndo, "%s", buf)) is executed. The attack vector involves the victim opening a specially crafted pcap file, allowing a potential attacker to disclose protected information.

Recommendations For tcpdump version 4.9.2, consider avoiding the use of the print prefix function in "print-hncp.c" until a patch is available. As a temporary workaround, restrict the opening of pcap files from untrusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.