CVE-2017-13028: The BOOTP parser in tcpdump before 4.9.2 has a buffer over-read in print-bootp.c:bootp_print().

Security readout for executives and security teams

Tcpdump versions before 4.9.2 could read beyond a BOOTP packet buffer while decoding traffic. For leaders, the concern is exposure on systems that inspect network traffic, because a crafted packet or capture could affect a trusted diagnostic tool. The bundle rates this critical, but does not cite active exploitation. Exposure is most likely on servers, appliances, analyst workstations, monitoring systems, or embedded platforms running tcpdump before 4.9.2 or vendor packages that include vulnerable tcpdump code. Prioritize remediation for network monitoring, incident response, and administrative systems because they intentionally process untrusted traffic. The issue is old and fixed, so this is mainly an exposure hygiene and legacy asset problem unless unsupported systems remain. Mitigation focus: Upgrade tcpdump to 4.9.2 or a vendor-fixed package.; Apply relevant Gentoo, Debian, Apple, or Red Hat updates where applicable.; Limit tcpdump use on untrusted captures until patched..

Prepared

May 22, 2026, 17:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.