Patch CVE-2019-8376, CVE-2019-8377 and CVE-2019-8381.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5205-1 advisory.

  - get_l2len in common/get.c in Tcpreplay 4.3.0 beta1 allows remote attackers to cause a denial of service     (heap-based buffer over-read and application crash) via crafted packets, as demonstrated by tcpprep.
    (CVE-2018-13112)

  - An issue was discovered in Tcpreplay 4.3.0 beta1. A heap-based buffer over-read was triggered in the     function dlt_en10mb_encode() of the file plugins/dlt_en10mb/en10mb.c, due to inappropriate values in the     function memmove(). The length (pktlen + ctx -> l2len) can be larger than source value (packet +     ctx->l2len) because the function fails to ensure the length of a packet is valid. This leads to Denial of     Service. (CVE-2018-17974)

  - A heap-based buffer over-read was discovered in the tcpreplay-edit binary of Tcpreplay 4.3.0 beta1, during     the incremental checksum operation. The issue gets triggered in the function csum_replace4() in     incremental_checksum.h, causing a denial of service. (CVE-2018-18407)

  - A use-after-free was discovered in the tcpbridge binary of Tcpreplay 4.3.0 beta1. The issue gets triggered     in the function post_args() at tcpbridge.c, causing a denial of service or possibly unspecified other     impact. (CVE-2018-18408)

  - A heap-based buffer over-read exists in the function fast_edit_packet() in the file send_packets.c of     Tcpreplay v4.3.0 beta1. This can lead to Denial of Service (DoS) and potentially Information Exposure when     the application attempts to process a crafted pcap file. (CVE-2018-17580)

  - Tcpreplay v4.3.0 beta1 contains a heap-based buffer over-read. The get_next_packet() function in the     send_packets.c file uses the memcpy() function unsafely to copy sequences from the source buffer pktdata     to the destination (*prev_packet)->pktdata. This will result in a Denial of Service (DoS) and potentially     Information Exposure when the application attempts to process a file. (CVE-2018-17582)

  - Tcpreplay before 4.3.1 has a heap-based buffer over-read in packet2tree in tree.c. (CVE-2018-20552)

  - Tcpreplay before 4.3.1 has a heap-based buffer over-read in get_l2len in common/get.c. (CVE-2018-20553)

  - tcprewrite in Tcpreplay through 4.3.2 has a heap-based buffer over-read during a get_c operation. The     issue is being triggered in the function get_ipv6_next() at common/get.c. (CVE-2020-12740)

  - An issue was discovered in tcpreplay tcpprep v4.3.3. There is a heap buffer overflow vulnerability in     MemcmpInterceptorCommon() that can make tcpprep crash and cause a denial of service. (CVE-2020-24265)

  - An issue was discovered in tcpreplay tcpprep v4.3.3. There is a heap buffer overflow vulnerability in     get_l2len() that can make tcpprep crash and cause a denial of service. (CVE-2020-24266)

  - Tcpreplay v4.4.1 was discovered to contain a double-free via __interceptor_free. (CVE-2022-27416)

  - Tcpreplay version 4.4.1 contains a memory leakage flaw in fix_ipv6_checksums() function. The highest     threat from this vulnerability is to data confidentiality. (CVE-2022-28487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This release (4.3.1) contains bug fixes only :

  - Fix checkspell detected typos (#531)

  - Heap overflow packet2tree and get_l2len (#530)

This is Tcpreplay suite 4.3.0

This release contains several bug fixes and enhancements :

  - Fix maxOS TOS checksum failure (#524)

  - TCP sequence edits seeding (#514)

  - Fix issues identifed by Codacy (#493)

  - CVE-2018-18408 use-after-free in post_args (#489)

  - CVE-2018-18407 heap-buffer-overflow csum_replace4 (#488)

  - CVE-2018-17974 heap-buffer-overflow dlt_en10mb_encode     (#486)

  - CVE-2018-17580 heap-buffer-overflow fast_edit_packet     (#485)

  - CVE-2018-17582 heap-buffer-overflow in get_next_packet     (#484)

  - Out-of-tree build (#482)

  - CVE-2018-13112 heap-buffer-overflow in get_l2len (#477     dup #408)

  - Closing stdin on pipe (#479)

  - Second pcap file hangs on multiplier option (#472)

  - Jumbo frame support for fragroute option (#466)

  - TCP sequence edit ACK corruption (#451)

  - TCP sequence number edit initial SYN packet should have     zero ACK (#450)

  - Travis CI build fails due to new build images (#432)

  - Upgrade libopts to 5.18.12 to address version build     issues (#430)

  - Add ability to change tcp SEQ/ACK numbers (#425)

  - Hang using loop and netmap options (#424)

  - tcpprep -S not working for large cache files (#423)

  - Unable to tcprewrite range of ports with --portmap     (#422)

  - --maxsleep broken for values less than 1000 (#421)

  - -T flag breaks traffic replay timing (#419)

  - Respect 2nd packet timing (#418)

  - Avoid non-blocking behaviour when using STDIN (#416)

  - pcap containing >1020 packets produces invalid cache     file (#415)

  - manpage typos (#413)

  - Fails to open tap0 on Zephyr (#411)

  - Heap-buffer-overflow in get_l2protocol (#410)

  - Heap-buffer-overflow in packet2tree (#409)

  - Heap-buffer-overflow in get_l2len (#408)

  - Heap-buffer-overflow in flow_decode (#407)

  - Rewrite zero IP total length field to match the actual     packet length (#406)

  - Stack-buffer-overflow in tcpcapinfo (#405)

  - tcpprep --include option does not exclude (#404)

  - Negative-size-param memset in dlt_radiotap_get_80211     (#402)

  - tcpeplay --verbose option not working (#398)

  - Fix replay when using --with-testnic (#178)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
123050	Fedora 29 : tcpreplay (2019-e40253f67e)	Nessus	Fedora Local Security Checks	3/25/2019	2/3/2020	critical
183169	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : Tcpreplay vulnerabilities (USN-5205-1)	Nessus	Ubuntu Local Security Checks	10/16/2023	10/16/2023	critical
124510	Fedora 30 : tcpreplay (2019-7d689dd314)	Nessus	Fedora Local Security Checks	5/2/2019	1/21/2020	critical
120955	Fedora 29 : tcpreplay (2018-5f91054677)	Nessus	Fedora Local Security Checks	1/7/2019	1/6/2021	critical
123045	Fedora 28 : tcpreplay (2019-a9c08d4b40)	Nessus	Fedora Local Security Checks	3/25/2019	2/3/2020	critical
120954	Fedora 28 : tcpreplay (2018-166b220ff1)	Nessus	Fedora Local Security Checks	1/7/2019	1/6/2021	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical