CVE-2017-13039: The ISAKMP parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c, several functions.

Security readout for executives and security teams

CVE-2017-13039 is a tcpdump parsing flaw. When tcpdump versions before 4.9.2 process ISAKMP traffic or capture data, the parser can read beyond a buffer. The provided sources do not show active exploitation or a CVSS score, so urgency depends on where tcpdump is installed and who can supply capture input. Systems running tcpdump before 4.9.2 are the likely exposure. Risk is higher on monitoring hosts, analyst workstations, appliances, or operational workflows that inspect untrusted traffic captures. The source bundle does not identify specific downstream products beyond vendor advisories from Gentoo, Debian, Apple, and Red Hat. Prioritize normal patch management unless tcpdump is used heavily in security monitoring or incident response with untrusted captures. There is no source-backed evidence of active exploitation, but older tcpdump installations should be remediated because packet parsers routinely handle attacker-controlled data. Mitigation focus: Upgrade tcpdump to 4.9.2 or a vendor-fixed package.; Apply relevant OS vendor security updates for affected distributions.; Limit tcpdump use on untrusted packet captures until updated..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.