CVE-2007-3798
critical · 9.8Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return value.
9.8
CVSS
70.4%
EPSS (exploit prob.)
99th
EPSS percentile
2007-07-16
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-252
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| tcpdump | tcpdump | <= 3.9.6 |
| canonical | ubuntu_linux | 6.06 |
| canonical | ubuntu_linux | 6.10 |
| canonical | ubuntu_linux | 7.04 |
| debian | debian_linux | 3.1 |
| debian | debian_linux | 4.0 |
| slackware | slackware | 9.0 |
| slackware | slackware | 9.1 |
| slackware | slackware | 10.0 |
| slackware | slackware | 10.1 |
| slackware | slackware | 10.2 |
| slackware | slackware | 11.0 |
| slackware | slackware | 12.0 |
| freebsd | freebsd | >= 5.0, < 5.5 |
| freebsd | freebsd | >= 6.0, < 6.1 |
| freebsd | freebsd | 5.5 |
| freebsd | freebsd | 5.5 |
| freebsd | freebsd | 5.5 |
| freebsd | freebsd | 5.5 |
| freebsd | freebsd | 5.5 |
| freebsd | freebsd | 5.5 |
| freebsd | freebsd | 5.5 |
| freebsd | freebsd | 5.5 |
| freebsd | freebsd | 5.5 |
| freebsd | freebsd | 5.5 |
| freebsd | freebsd | 5.5 |
| freebsd | freebsd | 5.5 |
| freebsd | freebsd | 5.5 |
| freebsd | freebsd | 6.1 |
| freebsd | freebsd | 6.1 |
| freebsd | freebsd | 6.1 |
| freebsd | freebsd | 6.1 |
| freebsd | freebsd | 6.1 |
| freebsd | freebsd | 6.1 |
| freebsd | freebsd | 6.1 |
| freebsd | freebsd | 6.1 |
| freebsd | freebsd | 6.1 |
| freebsd | freebsd | 6.1 |
| freebsd | freebsd | 6.1 |
| freebsd | freebsd | 6.1 |
Check a specific version with /api/v1/cve/match.
References
- http://bugs.gentoo.org/show_bug.cgi?id=184815
- http://cvs.tcpdump.org/cgi-bin/cvsweb/tcpdump/print-bgp.c?r1=1.91.2.11&r2=1.91.2.12
- http://docs.info.apple.com/article.html?artnum=307179
- http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
- http://secunia.com/advisories/26135
- http://secunia.com/advisories/26168
- http://secunia.com/advisories/26223
- http://secunia.com/advisories/26231
- http://secunia.com/advisories/26263
- http://secunia.com/advisories/26266
- http://secunia.com/advisories/26286
- http://secunia.com/advisories/26395
- http://secunia.com/advisories/26404
- http://secunia.com/advisories/26521
- http://secunia.com/advisories/27580
- http://secunia.com/advisories/28136
- http://security.freebsd.org/advisories/FreeBSD-SA-07:06.tcpdump.asc
- http://security.gentoo.org/glsa/glsa-200707-14.xml
- http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.449313
- http://www.debian.org/security/2007/dsa-1353
- http://www.digit-labs.org/files/exploits/private/tcpdump-bgp.c
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:148
- http://www.novell.com/linux/security/advisories/2007_16_sr.html
- http://www.redhat.com/support/errata/RHSA-2007-0368.html
- http://www.redhat.com/support/errata/RHSA-2007-0387.html
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2007-3798