get_l2len in common/get.c in Tcpreplay 4.3.0 beta1 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via crafted packets, as demonstrated by tcpprep.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5205-1 advisory.

    It was discovered that Tcpreplay incorrectly handled certain specially crafted packet capture input when     processed by tcpprep. An attacker could possibly use this issue to cause a denial of service. This issue     only affected Ubuntu 18.04 ESM. (CVE-2018-13112)

    It was discovered that Tcpreplay incorrectly handled certain specially crafted packet capture input. An     attacker could possibly use this issue to cause a denial of service or expose sensitive information. This     issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2018-17580, CVE-2018-17582)

    It was discovered that Tcpreplay incorrectly handled certain specially crafted packet capture input. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04     ESM and Ubuntu 18.04 ESM. (CVE-2018-17974, CVE-2018-18407)

    It was discovered that a use-after-free existed in Tcpreplay in the tcpbridge binary. An attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 ESM and Ubuntu     18.04 ESM. (CVE-2018-18408)

    It was discovered that Tcpreplay incorrectly handled certain specially crafted packet capture input. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04     ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2018-20552, CVE-2018-20553)

    It was discovered that a heap-based buffer over-read that existed in Tcpreplay caused an application crash     when tcprewrite or tcpreplay-edit received specially crafted packet capture input. An attacker could     possibly use this to cause a denial of service or to expose sensitive information. This issue only     affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12740)

    It was discovered that Tcpreplay incorrectly handled certain specially crafted packet capture input when     processed by tcpprep. An attacker could possibly use this issue to cause a denial of service. This issue     only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-24265, CVE-2020-24266)

    It was discovered that Tcpreplay incorrectly handled certain specially crafted packet capture input when     processed by tcprewrite. An attacker could possibly use this issue to cause a denial of service. This     issue only affected Ubuntu 22.04 ESM. (CVE-2022-27416)

    It was discovered that Tcpreplay did not properly manage memory under certain circumstances. If a user     were tricked into opening a specially crafted packet capture file, a remote attacker could possibly use     this issue to cause Tcpreplay crash, resulting in a denial of service, or possibly read sensitive data.
    This issue only affected Ubuntu 18.04 ESM, Ubuntu 20.04 ESM and Ubuntu 22.04 ESM. (CVE-2022-28487)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This release (4.3.1) contains bug fixes only :

  - Fix checkspell detected typos (#531)

  - Heap overflow packet2tree and get_l2len (#530)

This is Tcpreplay suite 4.3.0

This release contains several bug fixes and enhancements :

  - Fix maxOS TOS checksum failure (#524)

  - TCP sequence edits seeding (#514)

  - Fix issues identifed by Codacy (#493)

  - CVE-2018-18408 use-after-free in post_args (#489)

  - CVE-2018-18407 heap-buffer-overflow csum_replace4 (#488)

  - CVE-2018-17974 heap-buffer-overflow dlt_en10mb_encode     (#486)

  - CVE-2018-17580 heap-buffer-overflow fast_edit_packet     (#485)

  - CVE-2018-17582 heap-buffer-overflow in get_next_packet     (#484)

  - Out-of-tree build (#482)

  - CVE-2018-13112 heap-buffer-overflow in get_l2len (#477     dup #408)

  - Closing stdin on pipe (#479)

  - Second pcap file hangs on multiplier option (#472)

  - Jumbo frame support for fragroute option (#466)

  - TCP sequence edit ACK corruption (#451)

  - TCP sequence number edit initial SYN packet should have     zero ACK (#450)

  - Travis CI build fails due to new build images (#432)

  - Upgrade libopts to 5.18.12 to address version build     issues (#430)

  - Add ability to change tcp SEQ/ACK numbers (#425)

  - Hang using loop and netmap options (#424)

  - tcpprep -S not working for large cache files (#423)

  - Unable to tcprewrite range of ports with --portmap     (#422)

  - --maxsleep broken for values less than 1000 (#421)

  - -T flag breaks traffic replay timing (#419)

  - Respect 2nd packet timing (#418)

  - Avoid non-blocking behaviour when using STDIN (#416)

  - pcap containing >1020 packets produces invalid cache     file (#415)

  - manpage typos (#413)

  - Fails to open tap0 on Zephyr (#411)

  - Heap-buffer-overflow in get_l2protocol (#410)

  - Heap-buffer-overflow in packet2tree (#409)

  - Heap-buffer-overflow in get_l2len (#408)

  - Heap-buffer-overflow in flow_decode (#407)

  - Rewrite zero IP total length field to match the actual     packet length (#406)

  - Stack-buffer-overflow in tcpcapinfo (#405)

  - tcpprep --include option does not exclude (#404)

  - Negative-size-param memset in dlt_radiotap_get_80211     (#402)

  - tcpeplay --verbose option not working (#398)

  - Fix replay when using --with-testnic (#178)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183169	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : Tcpreplay vulnerabilities (USN-5205-1)	Nessus	Ubuntu Local Security Checks	critical
120955	Fedora 29 : tcpreplay (2018-5f91054677)	Nessus	Fedora Local Security Checks	critical
120954	Fedora 28 : tcpreplay (2018-166b220ff1)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2018-13112

high

Tenable Plugins

critical

critical

critical