What’s Vulnerable › Vulnerabilities

CVE-2007-3798

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 70.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2007-07-16 · updated 2026-06-16
• Weakness: CWE-252

Description

Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return value.

Affected products

• macOS: from 10.0.0 before 10.4.11 — fixed in 10.4.11
• Apple Mac Os X Server: from 10.0.0 before 10.4.11 — fixed in 10.4.11
• Canonical Ubuntu Linux: 6.06, 6.10, 7.04
• Debian Linux: 3.1, 4.0
• FreeBSD: from 5.0 before 5.5; from 6.0 before 6.1; 5.5, 5.5-p1, 5.5-p11, 5.5-p12, 5.5-p13, 5.5-p14 (+26) — fixed in 5.5, 6.1
• Slackware: 9.0, 9.1, 10.0, 10.1, 10.2, 11.0 (+1)
• The Tcpdump Group tcpdump: through 3.9.6

How to fix

Upgrade to a fixed version: macOS 10.4.11; Apple Mac Os X Server 10.4.11; FreeBSD 5.5, 6.1. Check the vendor advisory for mitigations.

References

• http://bugs.gentoo.org/show_bug.cgi?id=184815
• http://cvs.tcpdump.org/cgi-bin/cvsweb/tcpdump/print-bgp.c?r1=1.91.2.11&r2=1.91.2.12
• http://docs.info.apple.com/article.html?artnum=307179
• http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
• http://secunia.com/advisories/26135
• http://secunia.com/advisories/26168
• http://secunia.com/advisories/26223
• http://secunia.com/advisories/26231
• http://secunia.com/advisories/26263
• http://secunia.com/advisories/26266
• http://secunia.com/advisories/26286
• http://secunia.com/advisories/26395

Get alerted when CVE-2007-3798 or the next vulnerability affects your stack