PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5485 Tcpdump CVE debrief

CVE-2017-5485 is a critical buffer overflow in tcpdump’s ISO CLNS parser, specifically addrtoname.c:lookup_nsap(). The official record rates it CVSS 9.8 and maps affected tcpdump releases through 4.8.1. Systems that use tcpdump to process untrusted network traffic or packet data should be updated to a fixed release as a high priority.

Vendor
Tcpdump
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-28
Original CVE updated
2026-05-13
Advisory published
2017-01-28
Advisory updated
2026-05-13

Who should care

Security and platform teams that install or package tcpdump, administrators running packet capture or analysis workflows, and teams that process untrusted network traffic or capture data. Linux distribution maintainers should also confirm they have pulled in the vendor backports or errata tied to their packages.

Technical summary

The vulnerability is a memory-safety flaw in tcpdump’s ISO CLNS parsing path. The CVE description states that the parser in addrtoname.c:lookup_nsap() has a buffer overflow. NVD classifies the weakness as CWE-119 and gives the issue a CVSS v3.0 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The NVD CPE criteria mark tcpdump versions up to and including 4.8.1 as vulnerable, consistent with the description noting impact before 4.9.0.

Defensive priority

Immediate. This is a remotely reachable parser memory-corruption issue with critical severity, so patching or replacing affected tcpdump builds should be treated as urgent.

Recommended defensive actions

  • Upgrade tcpdump to a fixed release at 4.9.0 or later, or install the vendor backport/errata provided by your Linux distribution.
  • Inventory systems and automation that invoke tcpdump, especially where it may process untrusted traffic, packet captures, or uploaded traces.
  • If patching cannot be immediate, limit exposure by restricting who can run tcpdump and what inputs it can analyze.
  • Confirm package updates against vendor advisories for your platform, since the supplied references include Debian, Red Hat, and Gentoo notices for this CVE.
  • After remediation, verify the installed tcpdump version and retest packet-analysis workflows with nonproduction data.

Evidence notes

This debrief is based on the official CVE/NVD record and linked distributor advisories. The supplied NVD metadata describes a buffer overflow in addrtoname.c:lookup_nsap(), assigns CVSS 3.0 9.8, and identifies tcpdump versions through 4.8.1 as vulnerable. The CVE was published on 2017-01-28 and later modified in the NVD record on 2026-05-13; that later metadata update does not change the original disclosure date.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5485 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5485

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5485 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5485

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.