Vulnerability record · CVE-2007-3798 · published 16 July 2007
CVE-2007-3798: tcpdump BGP dissector integer overflow allows remote code execution
Tcpdump · Tcpdump
tcpdump 3.9.6 and earlier contains an integer overflow in print-bgp.c in the BGP dissector, reachable through crafted TLVs in a BGP packet and tied to an unchecked return value. Because tcpdump is widely used to inspect untrusted traffic, a malformed packet can crash or compromise the parsing process. The record does not list specific affected version ranges beyond "3.9.6 and earlier."
Description
Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return value.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 3.1 is 9.8 critical with network reachability and no privileges or interaction, and EPSS is very high with a public exploit reference, though KEV does not list it and the flaw is old.
What it is
tcpdump 3.9.6 and earlier contains an integer overflow in print-bgp.c in the BGP dissector, reachable through crafted TLVs in a BGP packet and tied to an unchecked return value. Because tcpdump is widely used to inspect untrusted traffic, a malformed packet can crash or compromise the parsing process. The record does not list specific affected version ranges beyond "3.9.6 and earlier."
Impact
An attacker can execute arbitrary code in the context of the tcpdump process, or at minimum crash it, when a crafted BGP packet is parsed. This gives code execution on the host running the capture, not just a denial of service.
Attack surface
The flaw is reached over the network by feeding a crafted BGP packet to the BGP dissector; the CVSS vector shows AV:N/AC:L/PR:N/UI:N, so no authentication or user interaction is required. Any deployment that captures or processes untrusted BGP traffic with an affected tcpdump build is exposed.
Exploitation
CVE-2007-3798 is not listed in CISA KEV, but EPSS is high at 0.70386 (99.35th percentile), and the references include an exploit link tagged "Exploit." That indicates public exploit material exists, though the record does not confirm active in-the-wild use.
What to do
- Upgrade tcpdump to a version later than 3.9.6; apply the vendor patch for your distribution (Debian DSA-1353, FreeBSD SA-07:06, Slackware, Red Hat, Apple, Gentoo GLSA 200707-14).
- If upgrade is not immediately possible, avoid running tcpdump against untrusted or unfiltered BGP traffic, and restrict capture to trusted interfaces and peers.
- Run tcpdump with least privilege and isolate capture hosts so code execution in the dissector does not reach production systems.
- Track vendor advisories for the listed products (Ubuntu, Debian, Slackware, FreeBSD, macOS/Mac OS X Server) and confirm the fix is applied on each.
- Review any historical packet captures or automation that processes BGP data with affected tcpdump builds.
Detection
- Monitor for tcpdump crashes or abnormal process exits when parsing BGP traffic, especially on capture hosts.
- Alert on unexpected child processes or outbound connections originating from tcpdump or capture tooling.
- Audit hosts and images for tcpdump versions 3.9.6 and earlier, and flag any that still process untrusted BGP packets.
- Watch for crafted BGP TLV patterns in captured traffic if packet-level logging is available.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
7 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2007-3798 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2007-3798), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
