CVE-2005-1267 json
The bgp_update_print function in tcpdump 3.x does not properly handle a -1 return value from the decode_prefix4 function, which allows remo…
published 2005-06-10 21 y ago modified 2026-06-16 4 mo ago also EUVD-2005-1270
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 13.5%
- EPSS 13.5% chance of exploitation in 30 days, percentile 96%
- public exploits
- 1
- Exploit-DB
Summary
The bgp_update_print function in tcpdump 3.x does not properly handle a -1 return value from the decode_prefix4 function, which allows remote attackers to cause a denial of service (infinite loop) via a crafted BGP packet.
Patch / fix
- tcpdump Debian 14, Debian 13, Debian 12 3.9.0.cvs.20050614-1
debian advisories DEBIAN-CVE-2005-1267
- tcpdump RHEL 4 14:3.8.2-10.RHEL4
- libpcap RHEL 4 14:0.8.3-10.RHEL4
- arpwatch RHEL 4 14:2.1a13-10.RHEL4
red hat advisories RHSA-2005:505
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2005-1267 updated
security flaw
-
Red Hat Enterprise Linux AS version 4 libpcap 0.8.3-10.RHEL4, tcpdump 3.8.2-10.RHEL4, arpwatch 2.1a13-10.RHEL4 Red Hat Enterprise Linux Desktop version 4 libpcap 0.8.3-10.RHEL4, tcpdump 3.8.2-10.RHEL4, arpwatch 2.1a13-10.RHEL4 Red Hat Enterprise Linux ES version 4 libpcap 0.8.3-10.RHEL4, tcpdump 3.8.2-10.RHEL4, arpwatch 2.1a13-10.RHEL4 Red Hat Enterprise Linux WS version 4 libpcap 0.8.3-10.RHEL4, tcpdump 3.8.2-10.RHEL4, arpwatch 2.1a13-10.RHEL4fixed: vendor fix RHSA-2005:505
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- First public exploit (EDB-1037)
- Published
Exploit prediction
13.50% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-1037 Tcpdump - bgp_update_print Remote Denial of Service dos, 2005-06-09
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
References
-
trustix.org
/errata/2005/0028/
vendor-advisory, patch
-
redhat.com
/archives/fedora-announce-list/2005-June/msg00007.html
vendor-advisory, patch
-
bugzilla.redhat.com
/bugzilla/show_bug.cgi?id=159208
patch, vendor-advisory
-
secunia.com
/advisories/15634/
third-party-advisory, patch, vendor-advisory
-
redhat.com
/support/errata/RHSA-2005-505.html
vendor-advisory
-
securityfocus.com
/archive/1/430292/100/0/threaded
vendor-advisory
-
debian.org
/security/2005/dsa-854
vendor-advisory
-
securityfocus.com
/bid/13906
vdb-entry
-
secunia.com
/advisories/17118
third-party-advisory
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11148
vdb-entry, signature
Sources
- CVE List CVE-2005-1267
- NVD CVE-2005-1267
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Fix old broken CPEs.