CVE-2019-1010220 Information disclosure in tcpdump

Low 3.3 Published 22 Jul 2019 Updated 5 Aug 2024

A buffer over-read in tcpdump allows attackers to expose stack memory contents by tricking users into opening a malicious pcap file.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-1010220?

CVE-2019-1010220 is a low-severity vulnerability in Tcpdump Tcpdump, published on 22 Jul 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

tcpdump.org tcpdump 4.9.2 is affected by: CWE-126: Buffer Over-read. The impact is: May expose Saved Frame Pointer, Return Address etc. on stack. The component is: line 234: "ND_PRINT((ndo, "%s", buf));", in function named "print_prefix", in "print-hncp.c". The attack vector is: The victim must open a specially crafted pcap file.

Weakness: CWE-125, CWE-126

Which versions are affected by CVE-2019-1010220?

It affects 1 product.

Products include Tcpdump Tcpdump.

How do I fix CVE-2019-1010220?

Upgrade to a fixed version.

Is CVE-2019-1010220 being exploited?

There is no known exploitation of CVE-2019-1010220 in the wild and no public exploit code.

All Tcpdump Tcpdump vulnerabilities

Sources

Also known as DEBIAN-CVE-2019-1010220, ECHO-04e2-597a-f713, GHSA-fj2x-3wgg-g9c7, UBUNTU-CVE-2019-1010220.