CVE-2007-3798

tcpdump - Print-bgp.C Remote Integer Underflow

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return value.

Un desbordamiento de enteros en el archivo print-bgp.c en el disector BGP en tcpdump versión 3.9.6 y anteriores, permite a atacantes remotos ejecutar código arbitrario por medio de TLVs especialmente diseñados en un paquete BGP, relacionado a un valor de retorno no comprobado.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

Poc

Automatable

Yes

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2007-03-01 First Exploit
2007-07-16 CVE Reserved
2007-07-16 CVE Published
2024-04-11 EPSS Updated
2024-10-15 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-190: Integer Overflow or Wraparound
CWE-252: Unchecked Return Value

CAPEC

References (38)

URL	Tag	Source
http://bugs.gentoo.org/show_bug.cgi?id=184815	Third Party Advisory
http://cvs.tcpdump.org/cgi-bin/cvsweb/tcpdump/print-bgp.c?r1=1.91.2.11&r2=1.91.2.12	Broken Link
http://docs.info.apple.com/article.html?artnum=307179	Broken Link
http://www.securityfocus.com/archive/1/474225/100/0/threaded	Broken Link
http://www.securityfocus.com/bid/24965	Broken Link
http://www.securitytracker.com/id?1018434	Broken Link
http://www.us-cert.gov/cas/techalerts/TA07-352A.html	Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9771	Broken Link

URL	Date	SRC
https://www.exploit-db.com/exploits/30319	2007-03-01
http://www.digit-labs.org/files/exploits/private/tcpdump-bgp.c	2024-10-15

URL	Date	SRC
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.449313	2024-01-12

URL	Date	SRC
http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html	2024-01-12
http://secunia.com/advisories/26135	2024-01-12
http://secunia.com/advisories/26168	2024-01-12
http://secunia.com/advisories/26223	2024-01-12
http://secunia.com/advisories/26231	2024-01-12
http://secunia.com/advisories/26263	2024-01-12
http://secunia.com/advisories/26266	2024-01-12
http://secunia.com/advisories/26286	2024-01-12
http://secunia.com/advisories/26395	2024-01-12
http://secunia.com/advisories/26404	2024-01-12
http://secunia.com/advisories/26521	2024-01-12
http://secunia.com/advisories/27580	2024-01-12
http://secunia.com/advisories/28136	2024-01-12
http://security.freebsd.org/advisories/FreeBSD-SA-07:06.tcpdump.asc	2024-01-12
http://security.gentoo.org/glsa/glsa-200707-14.xml	2024-01-12
http://www.debian.org/security/2007/dsa-1353	2024-01-12
http://www.mandriva.com/security/advisories?name=MDKSA-2007:148	2024-01-12
http://www.novell.com/linux/security/advisories/2007_16_sr.html	2024-01-12
http://www.redhat.com/support/errata/RHSA-2007-0368.html	2024-01-12
http://www.redhat.com/support/errata/RHSA-2007-0387.html	2024-01-12
http://www.trustix.org/errata/2007/0023	2024-01-12
http://www.turbolinux.com/security/2007/TLSA-2007-46.txt	2024-01-12
http://www.ubuntu.com/usn/usn-492-1	2024-01-12
http://www.vupen.com/english/advisories/2007/2578	2024-01-12
http://www.vupen.com/english/advisories/2007/4238	2024-01-12
https://access.redhat.com/security/cve/CVE-2007-3798	2007-11-15
https://bugzilla.redhat.com/show_bug.cgi?id=250275	2007-11-15

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Tcpdump Search vendor "Tcpdump"		Tcpdump Search vendor "Tcpdump" for product "Tcpdump"				<= 3.9.6 Search vendor "Tcpdump" for product "Tcpdump" and version " <= 3.9.6"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				6.06 Search vendor "Canonical" for product "Ubuntu Linux" and version "6.06"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				6.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "6.10"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				7.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "7.04"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				3.1 Search vendor "Debian" for product "Debian Linux" and version "3.1"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0"		-		Affected
Slackware Search vendor "Slackware"		Slackware Search vendor "Slackware" for product "Slackware"				9.0 Search vendor "Slackware" for product "Slackware" and version "9.0"		-		Affected
Slackware Search vendor "Slackware"		Slackware Search vendor "Slackware" for product "Slackware"				9.1 Search vendor "Slackware" for product "Slackware" and version "9.1"		-		Affected
Slackware Search vendor "Slackware"		Slackware Search vendor "Slackware" for product "Slackware"				10.0 Search vendor "Slackware" for product "Slackware" and version "10.0"		-		Affected
Slackware Search vendor "Slackware"		Slackware Search vendor "Slackware" for product "Slackware"				10.1 Search vendor "Slackware" for product "Slackware" and version "10.1"		-		Affected
Slackware Search vendor "Slackware"		Slackware Search vendor "Slackware" for product "Slackware"				10.2 Search vendor "Slackware" for product "Slackware" and version "10.2"		-		Affected
Slackware Search vendor "Slackware"		Slackware Search vendor "Slackware" for product "Slackware"				11.0 Search vendor "Slackware" for product "Slackware" and version "11.0"		-		Affected
Slackware Search vendor "Slackware"		Slackware Search vendor "Slackware" for product "Slackware"				12.0 Search vendor "Slackware" for product "Slackware" and version "12.0"		-		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				>= 5.0 < 5.5 Search vendor "Freebsd" for product "Freebsd" and version " >= 5.0 < 5.5"		-		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				>= 6.0 < 6.1 Search vendor "Freebsd" for product "Freebsd" and version " >= 6.0 < 6.1"		-		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				5.5 Search vendor "Freebsd" for product "Freebsd" and version "5.5"		-		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				5.5 Search vendor "Freebsd" for product "Freebsd" and version "5.5"		p1		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				5.5 Search vendor "Freebsd" for product "Freebsd" and version "5.5"		p11		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				5.5 Search vendor "Freebsd" for product "Freebsd" and version "5.5"		p12		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				5.5 Search vendor "Freebsd" for product "Freebsd" and version "5.5"		p13		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				5.5 Search vendor "Freebsd" for product "Freebsd" and version "5.5"		p14		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				5.5 Search vendor "Freebsd" for product "Freebsd" and version "5.5"		p2		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				5.5 Search vendor "Freebsd" for product "Freebsd" and version "5.5"		p3		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				5.5 Search vendor "Freebsd" for product "Freebsd" and version "5.5"		p4		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				5.5 Search vendor "Freebsd" for product "Freebsd" and version "5.5"		p5		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				5.5 Search vendor "Freebsd" for product "Freebsd" and version "5.5"		p7		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				5.5 Search vendor "Freebsd" for product "Freebsd" and version "5.5"		p8		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				5.5 Search vendor "Freebsd" for product "Freebsd" and version "5.5"		p9		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.1 Search vendor "Freebsd" for product "Freebsd" and version "6.1"		-		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.1 Search vendor "Freebsd" for product "Freebsd" and version "6.1"		p1		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.1 Search vendor "Freebsd" for product "Freebsd" and version "6.1"		p10		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.1 Search vendor "Freebsd" for product "Freebsd" and version "6.1"		p11		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.1 Search vendor "Freebsd" for product "Freebsd" and version "6.1"		p12		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.1 Search vendor "Freebsd" for product "Freebsd" and version "6.1"		p13		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.1 Search vendor "Freebsd" for product "Freebsd" and version "6.1"		p16		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.1 Search vendor "Freebsd" for product "Freebsd" and version "6.1"		p17		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.1 Search vendor "Freebsd" for product "Freebsd" and version "6.1"		p18		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.1 Search vendor "Freebsd" for product "Freebsd" and version "6.1"		p2		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.1 Search vendor "Freebsd" for product "Freebsd" and version "6.1"		p4		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.1 Search vendor "Freebsd" for product "Freebsd" and version "6.1"		p6		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.1 Search vendor "Freebsd" for product "Freebsd" and version "6.1"		p7		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.1 Search vendor "Freebsd" for product "Freebsd" and version "6.1"		p9		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.2 Search vendor "Freebsd" for product "Freebsd" and version "6.2"		-		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.2 Search vendor "Freebsd" for product "Freebsd" and version "6.2"		p1		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.2 Search vendor "Freebsd" for product "Freebsd" and version "6.2"		p4		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.2 Search vendor "Freebsd" for product "Freebsd" and version "6.2"		p5		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.2 Search vendor "Freebsd" for product "Freebsd" and version "6.2"		p6		Affected
Apple Search vendor "Apple"		Mac Os X Search vendor "Apple" for product "Mac Os X"				>= 10.0.0 < 10.4.11 Search vendor "Apple" for product "Mac Os X" and version " >= 10.0.0 < 10.4.11"		-		Affected
Apple Search vendor "Apple"		Mac Os X Server Search vendor "Apple" for product "Mac Os X Server"				>= 10.0.0 < 10.4.11 Search vendor "Apple" for product "Mac Os X Server" and version " >= 10.0.0 < 10.4.11"		-		Affected