A vulnerability was found in appneta tcpreplay up to 4.4.4. It has been classified as problematic. This affects the function get_layer4_v6 of the file /tcpreplay/src/common/get.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-258333 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20119-1 advisory.

    - update to 4.5.2:
      * features added since 4.4.4
        - fix/recalculate header checksum for ipv6-frag
        - IPv6 frag checksum support
        - AF_XDP socket support
        - tcpreplay -w (write into a pcap file)
        - tcpreplay --fixhdrlen
        - --include and --exclude options
        - SLL2 support
        - Haiku support
      * security fixes reported for 4.4.4 fixed in 4.5.2
        - CVE-2023-4256  / bsc#1218249
        - CVE-2023-43279 / bsc#1221324
        - CVE-2024-3024  / bsc#1222131 (likely)
        - CVE-2024-22654 / bsc#1243845
        - CVE-2025-9157  / bsc#1248322
        - CVE-2025-9384  / bsc#1248595
        - CVE-2025-9385  / bsc#1248596
        - CVE-2025-9386  / bsc#1248597
        - CVE-2025-9649  / bsc#1248964
        - CVE-2025-51006 / bsc#1250356

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability was found in appneta tcpreplay up to 4.4.4. It has been classified as problematic. This     affects the function get_layer4_v6 of the file /tcpreplay/src/common/get.c. The manipulation leads to     heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the     public and may be used. The identifier VDB-258333 was assigned to this vulnerability. NOTE: The vendor was     contacted early about this disclosure but did not respond in any way. (CVE-2024-3024)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-ecd4cc8435 advisory.

    Announcing v4.5.1

    This release contains contributions from a record number of new contributors. This is greatly appreciated     since I am a team of one, and do Tcpreplay maintenance in my spare time.

    There are many bug fixes and new features. Most notable features:

     - AF_XDP socket support - if you have a newer Linux kernel, you will be able to transmit at line rates     without having to install 3rd party kernel modules (e.g. netmap, PF_RING)
     - -w tcpreplay option - this overrides the -i option, and allows you to write to a PCAP file rather than     an interface
     - --include and --exclude tcpreplay options - allows replay of a list of specific packet numbers to     replay. This may slow things down, so consider using in combination with -w.
     - --fixhdrlen tcpreplay option - added to control action on packet length changes
     - -W tcpreplay option - suppress warnings when replaying
     - SLL2( Linux cooked capture encapsulation v2)
     - Haiku support

    What's Changed

     - Add support for LINUX_SLL2 by @btriller in #728
     - Feature #727 - Linux SLL v2 by @fklassen in #820
     - Bug #779 - honour overflow for all PPS values by @fklassen in #821
     - AF_XDP socket extension using libxdp api by @plangarbalint in #797
     - Feature #822 - AF_XDP socket extension by @fklassen in #823
     - Nanosec accurate packet processing by @plangarbalint in #796
     - Handle IPv6 fragment extension header by @ChuckCottrill in #832
     - Bug #837 - handle IPv6 fragment extension header by @fklassen in #838
     - Feature #796 - nanosecond packet processing by @fklassen in #836
     - configure.ac: unify search dirs for pcap and add lib32 by @shr-project in #819
     - Feature #839 - add pull request template by @fklassen in #840
     - ipv6 - add check for extension header length by @GabrielGanne in #842
     - Bug #827 PR #842 IPv6 extension header - staging by @fklassen in #859
     - add check for empty cidr by @GabrielGanne in #843
     - Bug #824 and PR #843: check for empty CIDR by @fklassen in #860
     - Add option to turn on/off fix packet header length by @ChuckCottrill in #846
     - Bug #703 #844 PR #846: optionally fix packet header length --fixhdrlen by @fklassen in #861
     - Bug 863: fix nansecond timestamp regression by @fklassen in #865
     - autotools - AC_HELP_STRING is obsolete in 2.70 by @GabrielGanne in #856
     - some Haiku support by @infrastation in #847
     - configure.ac: do not run conftest in case of cross compilation by @ChenQi1989 in #849
     - dlt_jnpr_ether_cleanup: check config before cleanup by @Marsman1996 in #851
     - Fix recursive tcpedit cleanup by @GabrielGanne in #855
     - Bug #813: back out PR #855 by @fklassen in #866
     - Bug #867 - run regfree() on close by @fklassen in #868
     - Bug #869 tcpprep memory leak include exclude by @fklassen in #870
     - Bug #811 - add check for invalid jnpr header length by @fklassen in #872
     - Bug #792 avoid assertion and other fixes by @fklassen in #873
     - Bug #844 tap: ignore TUNSETIFF EBUSY errors by @fklassen in #874
     - Bug #876 - add missing free_umem_and_xsk function by @fklassen in #877
     - Feature #878 - add -w / --suppress-warning option by @fklassen in #879
     - Bug #835 false unsupported dlt warnings on 802.3 (Ethernet I) and LLC by @fklassen in #880
     - Feature #884 include exclude options by @fklassen in #885
     - Feature #853 direct traffic to pcap by @fklassen in #871
     - Feature #853 restore missing -P command by @fklassen in #887
     - Bug #888: check for map == NULL in cidr.c by @fklassen in #889


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
277019	openSUSE 16 Security Update : tcpreplay (openSUSE-SU-2025-20119-1)	Nessus	SuSE Local Security Checks	Local	medium
256905	Linux Distros Unpatched Vulnerability : CVE-2024-3024	Nessus	Misc.	Local	high
202743	Fedora 40 : tcpreplay (2024-ecd4cc8435)	Nessus	Fedora Local Security Checks	Local	high

Detections

Analytics

CVE-2024-3024

high

Tenable Plugins

medium

high

high