tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv4() at tree.c.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv6() at tree.c (CVE-2021-45386)

  - tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv4() at tree.c. (CVE-2021-45387)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv4() at tree.c. (CVE-2021-45387)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202210-08 (Tcpreplay: Multiple Vulnerabilities)

  - tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv6() at tree.c (CVE-2021-45386)

  - tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv4() at tree.c. (CVE-2021-45387)

  - Tcpreplay v4.4.1 was discovered to contain a double-free via __interceptor_free. (CVE-2022-27416)

  - Tcpreplay v4.4.1 has a heap-based buffer overflow in do_checksum_math at /tcpedit/checksum.c.
    (CVE-2022-27418)

  - tcprewrite in Tcpreplay 4.4.1 has a reachable assertion in get_layer4_v6 in common/get.c. (CVE-2022-27939)

  - tcprewrite in Tcpreplay 4.4.1 has a heap-based buffer over-read in get_ipv6_next in common/get.c.
    (CVE-2022-27940)

  - tcprewrite in Tcpreplay 4.4.1 has a heap-based buffer over-read in get_l2len_protocol in common/get.c.
    (CVE-2022-27941)

  - tcpprep in Tcpreplay 4.4.1 has a heap-based buffer over-read in parse_mpls in common/get.c.
    (CVE-2022-27942)

  - Tcpreplay version 4.4.1 contains a memory leakage flaw in fix_ipv6_checksums() function. The highest     threat from this vulnerability is to data confidentiality. (CVE-2022-28487)

  - The component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in     get_ipv6_next at common/get.c:713. NOTE: this is different from CVE-2022-27940. (CVE-2022-37047)

  - The component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in     get_l2len_protocol at common/get.c:344. NOTE: this is different from CVE-2022-27941. (CVE-2022-37048)

  - The component tcpprep in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in     parse_mpls at common/get.c:150. NOTE: this is different from CVE-2022-27942. (CVE-2022-37049)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
426535	Alpine: multiple tcpreplay packages: security update to 4.4.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
426535	Alpine: multiple tcpreplay packages: security update to 4.4.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
224445	Linux Distros Unpatched Vulnerability : CVE-2021-45387	Nessus	Misc.	medium
166164	GLSA-202210-08 : Tcpreplay: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2021-45387

medium

Tenable Plugins

medium

medium

medium

high