CVE-2017-12990 : What You Need to Know

This CVE-2017-12990 article provides insights into a vulnerability in tcpdump that could lead to an infinite loop due to bugs in print-isakmp.c.

Understanding CVE-2017-12990

What is CVE-2017-12990?

The vulnerability in print-isakmp.c functions of tcpdump before version 4.9.2 could cause the ISAKMP parser to enter an endless loop.

The Impact of CVE-2017-12990

The vulnerability could potentially lead to a denial of service (DoS) condition by causing the ISAKMP parser to get stuck in an infinite loop.

Technical Details of CVE-2017-12990

Vulnerability Description

The issue originates from bugs in print-isakmp.c functions, leading to an infinite loop in the ISAKMP parser of tcpdump.

Affected Systems and Versions

Affected versions: tcpdump versions prior to 4.9.2

Exploitation Mechanism

Exploiting the vulnerability involves triggering the specific functions in print-isakmp.c, causing the ISAKMP parser to loop indefinitely.

Mitigation and Prevention

Immediate Steps to Take

Update tcpdump to version 4.9.2 or later to mitigate the vulnerability.
Monitor vendor advisories for patches and apply them promptly.

Long-Term Security Practices

Regularly update software and systems to prevent known vulnerabilities.
Employ network monitoring tools to detect unusual traffic patterns that may indicate exploitation attempts.

Patching and Updates

Apply patches provided by tcpdump or respective vendors to address the vulnerability.