tcprewrite in Tcpreplay through 4.3.2 has a heap-based buffer over-read during a get_c operation. The issue is being triggered in the function get_ipv6_next() at common/get.c.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5205-1 advisory.

    It was discovered that Tcpreplay incorrectly handled certain specially crafted packet capture input when     processed by tcpprep. An attacker could possibly use this issue to cause a denial of service. This issue     only affected Ubuntu 18.04 ESM. (CVE-2018-13112)

    It was discovered that Tcpreplay incorrectly handled certain specially crafted packet capture input. An     attacker could possibly use this issue to cause a denial of service or expose sensitive information. This     issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2018-17580, CVE-2018-17582)

    It was discovered that Tcpreplay incorrectly handled certain specially crafted packet capture input. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04     ESM and Ubuntu 18.04 ESM. (CVE-2018-17974, CVE-2018-18407)

    It was discovered that a use-after-free existed in Tcpreplay in the tcpbridge binary. An attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 ESM and Ubuntu     18.04 ESM. (CVE-2018-18408)

    It was discovered that Tcpreplay incorrectly handled certain specially crafted packet capture input. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04     ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2018-20552, CVE-2018-20553)

    It was discovered that a heap-based buffer over-read that existed in Tcpreplay caused an application crash     when tcprewrite or tcpreplay-edit received specially crafted packet capture input. An attacker could     possibly use this to cause a denial of service or to expose sensitive information. This issue only     affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12740)

    It was discovered that Tcpreplay incorrectly handled certain specially crafted packet capture input when     processed by tcpprep. An attacker could possibly use this issue to cause a denial of service. This issue     only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-24265, CVE-2020-24266)

    It was discovered that Tcpreplay incorrectly handled certain specially crafted packet capture input when     processed by tcprewrite. An attacker could possibly use this issue to cause a denial of service. This     issue only affected Ubuntu 22.04 ESM. (CVE-2022-27416)

    It was discovered that Tcpreplay did not properly manage memory under certain circumstances. If a user     were tricked into opening a specially crafted packet capture file, a remote attacker could possibly use     this issue to cause Tcpreplay crash, resulting in a denial of service, or possibly read sensitive data.
    This issue only affected Ubuntu 18.04 ESM, Ubuntu 20.04 ESM and Ubuntu 22.04 ESM. (CVE-2022-28487)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This release contains bug fixes only (which includes security fixes) :

  - Increase cache buffers size to accomodate VLAN edits     (#594)

  - Correct L2 header length to correct IP header offset     (#583)

  - Fix warnings from gcc version 10 (#580)

  - Heap Buffer Overflow in randomize_iparp (#579)

  - Use after free in get_ipv6_next (#578)

  - Heap Buffer Overflow in git_ipv6_next (#576)

  - Call pcap_freecode() on pcap_compile() (#572)

  - Increase max snaplen to 262144 (#571)

  - Fix divide by zero in fuzzing (#570)

  - Unique IP repeats at very high iteration counts (#566)

  - Fails to compile on FreeBSD amd64 13.0 (#558)

  - Heap Buffer Overflow in do_checksum (#556) (#577)

  - Attempt to correct corrupt pcap files, if possible     (#557)

  - Fix GCC v10 warnings (#555)

  - Remove some duplicated SOURCES entries (#551)

  - Expand /dev/bpfX hard limit to fix macOS Mojave (#550)

  - Implement --loopdelay-ms when using --loop=0 (#546)

  - Heap overflow packet2tree and get_l2len (#530)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183169	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : Tcpreplay vulnerabilities (USN-5205-1)	Nessus	Ubuntu Local Security Checks	critical
137788	Fedora 31 : tcpreplay (2020-256ac53cc7)	Nessus	Fedora Local Security Checks	critical
137767	Fedora 32 : tcpreplay (2020-f47830961a)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2020-12740

critical

Tenable Plugins

critical

critical

critical