CVE-2004-0184

CVE-2004-0184 is a medium-severity vulnerability in Tcpdump with a CVSS 2.0 base score of 5.0. Its EPSS exploit-prediction score of 60% places it in the 99th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-125.

Key facts

• Severity: Medium (CVSS 2.0 base score 5.0)
• EPSS exploit prediction: 60% (99th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-125
• Affected product: Tcpdump
• Published: 2004-05-04
• Last modified: 2026-06-16

Description

Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with an Identification payload with a length that becomes less than 8 during byte order conversion, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.

Frequently asked questions

What is CVE-2004-0184?

Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with an Identification payload with a length that becomes less than 8 during byte order conversion, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.

How severe is CVE-2004-0184?

CVE-2004-0184 has a CVSS 2.0 base score of 5.0, rated medium severity.

Is CVE-2004-0184 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 60% (99th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2004-0184?

CVE-2004-0184 affects Tcpdump. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2004-0184?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2004-0184 published?

CVE-2004-0184 was published on 2004-05-04 and last updated on 2026-06-16.

References

• http://marc.info/?l=bugtraq&m=108067265931525&w=2
• http://secunia.com/advisories/11258
• http://securitytracker.com/id?1009593
• http://www.debian.org/security/2004/dsa-478
• http://www.kb.cert.org/vuls/id/492558
• http://www.rapid7.com/advisories/R7-0017.html
• http://www.redhat.com/support/errata/RHSA-2004-219.html
• http://www.securityfocus.com/bid/10004
• http://www.tcpdump.org/tcpdump-changes.txt
• http://www.trustix.org/errata/2004/0015
• https://bugzilla.fedora.us/show_bug.cgi?id=1468
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15679
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9581
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A976

Affected products (1)

• cpe:2.3:a:tcpdump:tcpdump:*:*:*:*:*:*:*:*

More vulnerabilities in Tcpdump

• CVE-2018-10105 — Critical (CVSS 9.8): tcpdump before 4.9.3 mishandles the printing of SMB data (issue 2 of 2).
• CVE-2018-10103 — Critical (CVSS 9.8): tcpdump before 4.9.3 mishandles the printing of SMB data (issue 1 of 2).
• CVE-2017-13725 — Critical (CVSS 9.8): The IPv6 routing header parser in tcpdump before 4.9.2 has a buffer over-read in print-rt6.c:rt6_print().
• CVE-2017-13690 — Critical (CVSS 9.8): The IKEv2 parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c, several functions.
• CVE-2017-13689 — Critical (CVSS 9.8): The IKEv1 parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:ikev1_id_print().
• CVE-2017-13688 — Critical (CVSS 9.8): The OLSR parser in tcpdump before 4.9.2 has a buffer over-read in print-olsr.c:olsr_print().

All CVEs affecting Tcpdump →

Other CWE-125 (Out-of-bounds Read) vulnerabilities

• CVE-2026-24826 — Critical (CVSS 10.0): Out-of-bounds Write, Divide By Zero, NULL Pointer Dereference, Use of Uninitialized Resource, Out-of-bounds Read,…
• CVE-2024-22004 — Critical (CVSS 10.0): Due to length check, an attacker with privilege access on a Linux Nonsecure operating system can trigger a…
• CVE-2021-41556 — Critical (CVSS 10.0): sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that…
• CVE-2021-21777 — Critical (CVSS 10.0): An information disclosure vulnerability exists in the Ethernet/IP UDP handler functionality of EIP Stack Group OpENer…
• CVE-2017-14451 — Critical (CVSS 10.0): An exploitable out-of-bounds read vulnerability exists in libevm (Ethereum Virtual Machine) of CPP-Ethereum. A…
• CVE-2013-0767 — Critical (CVSS 10.0): The nsSVGPathElement::GetPathLengthScale function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and…

Browse all CWE-125 (Out-of-bounds Read) vulnerabilities →