CVE-2004-0184: tcpdump Out-of-bounds Read
Vulnerability summary
CVE-2004-0184 is a medium (CVSS 5.0) Out-of-bounds Read vulnerability in tcpdump. EPSS estimates a 60.35% chance of exploitation in the next 30 days, higher than 99.1% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 06-04-2004PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with an Identification payload with a length that becomes less than 8 during byte order conversion, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
60.35%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 60.35% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (rapid7.com)
Maturity: unknown
tcpdump - ISAKMP Identification Payload Integer Overflow
Maturity: weaponized
Weaknesses
CWE · root cause- CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
- CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Affected systems
Debian1 product
- tcpdump< 3.7.2-4
Tcpdump1 product
- tcpdump≤ 3.8.1
2 vendors · 2 products
References
15 links
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9581VDB EntrySignatureX Refsource OVALBroken Link
Show all 15 references
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A976VDB EntrySignatureX Refsource OVALBroken Link