Vulnerability record · CVE-2004-0184 · published 4 May 2004
CVE-2004-0184: tcpdump ISAKMP ID payload integer underflow causes crash
Tcpdump · Tcpdump
tcpdump 3.8.1 and earlier mishandles the Identification payload in ISAKMP packets: a length value that drops below 8 during byte order conversion triggers an integer underflow and an out-of-bounds read. The result is a crash of the tcpdump process, so the flaw is a denial of service in the packet parser rather than a memory-corruption path.
Description
Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with an Identification payload with a length that becomes less than 8 during byte order conversion, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.
AV:N/AC:L/Au:N/C:N/I:N/A:P
Automated analysis
medium priorityRemote, unauthenticated and easy to trigger with public exploit material, but the confirmed effect is only a denial of service with no code execution or data loss.
What it is
tcpdump 3.8.1 and earlier mishandles the Identification payload in ISAKMP packets: a length value that drops below 8 during byte order conversion triggers an integer underflow and an out-of-bounds read. The result is a crash of the tcpdump process, so the flaw is a denial of service in the packet parser rather than a memory-corruption path.
Impact
A remote attacker can crash tcpdump while it parses a crafted ISAKMP packet, interrupting packet capture and any monitoring or IDS pipeline that depends on it. No code execution or data disclosure is described in the record.
Attack surface
Reached over the network by sending a malformed ISAKMP packet that tcpdump processes; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction beyond the tool reading the traffic.
Exploitation
Not listed in CISA KEV, but EPSS is high at roughly 0.60 (99th percentile) and a Rapid7 advisory reference is tagged Exploit, indicating public exploit material exists. No ransomware group is documented as using it.
What to do
- Upgrade tcpdump to a version later than 3.8.1; the tcpdump release notes and Debian DSA-478 reference the fix.
- Apply the vendor patches referenced in the Debian, Red Hat and Trustix advisories for packaged tcpdump builds.
- If upgrading is not immediately possible, avoid running tcpdump with elevated privileges on untrusted network segments and restrict who can feed it traffic.
- Filter or rate-limit ISAKMP/UDP 500 traffic at the perimeter where it is not required.
Detection
- Monitor for tcpdump process crashes or unexpected restarts on capture hosts and correlate with ISAKMP traffic.
- Alert on ISAKMP Identification payloads with anomalous length fields in packet captures or IDS logs.
- Track tcpdump versions in use and flag any host still running 3.8.1 or earlier.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2004-0184 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2004-0184), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
