Description
Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return value.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tcpdump | 3.9.5-3 | — |
| Debian 13 | tcpdump | 3.9.5-3 | — |
| Debian 12 | tcpdump | 3.9.5-3 | — |
| Debian 4.0 | tcpdump | 3.9.5-2etch1 | DSA-1353-1 |
| Debian 3.1 | tcpdump | 3.8.3-5sarge3 | DSA-1353-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | arpwatch | 14:2.1a13-18.el5 | RHSA-2007:0368 |
| RHEL 5 | libpcap +1 | 14:0.9.4-11.el5 | RHSA-2007:0368 |
| RHEL 5 | tcpdump | 14:3.9.4-11.el5 | RHSA-2007:0368 |
| RHEL 4 | arpwatch | 14:2.1a13-12.el4 | RHSA-2007:0387 |
| RHEL 4 | libpcap | 14:0.8.3-12.el4 | RHSA-2007:0387 |
| RHEL 4 | tcpdump | 14:3.8.2-12.el4 | RHSA-2007:0387 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- tcpdump - Print-bgp.C Remote Integer Underflow EDB-30319 · remote · Mar 1, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2007:0368 Red Hat Security Advisory: tcpdump security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0387 Red Hat Security Advisory: tcpdump security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1353-1 tcpdump - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2007:0387 vendor-advisory
- 26231 third-party-advisory
- SUSE-SR:2007:016 vendor-advisory
- ADV-2007-4238 vdb-entry
- TA07-352A third-party-advisory
- 26168 third-party-advisory
- 27580 third-party-advisory
- 28136 third-party-advisory
- 26286 third-party-advisory
- http://www.digit-labs.org/files/exploits/private/tcpdump-bgp.c
- http://bugs.gentoo.org/show_bug.cgi?id=184815
- SSA:2007-230-01 vendor-advisory
- MDKSA-2007:148 vendor-advisory
- 1018434 vdb-entry
- RHSA-2007:0368 vendor-advisory
- 26263 third-party-advisory
- 20070720 rPSA-2007-0147-1 tcpdump mailing-list
- 26223 third-party-advisory
- APPLE-SA-2007-12-17 vendor-advisory
- 2007-0023 vendor-advisory
- oval:org.mitre.oval:def:9771 vdb-entry signature
- FreeBSD-SA-07:06 vendor-advisory
- http://cvs.tcpdump.org/cgi-bin/cvsweb/tcpdump/print-bgp.c?r1=1.91.2.11&r2=1.91.2.12
- http://docs.info.apple.com/article.html?artnum=307179
- 26395 third-party-advisory
- 26266 third-party-advisory
- TLSA-2007-46 vendor-advisory
- 26521 third-party-advisory
- ADV-2007-2578 vdb-entry
- 26404 third-party-advisory
- 26135 third-party-advisory
- USN-492-1 vendor-advisory
- DSA-1353 vendor-advisory
- GLSA-200707-14 vendor-advisory
- 24965 vdb-entry