Tcpreplay v4.4.1 was discovered to contain a double-free via __interceptor_free.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5205-1 advisory.

    It was discovered that Tcpreplay incorrectly handled certain specially crafted packet capture input when     processed by tcpprep. An attacker could possibly use this issue to cause a denial of service. This issue     only affected Ubuntu 18.04 ESM. (CVE-2018-13112)

    It was discovered that Tcpreplay incorrectly handled certain specially crafted packet capture input. An     attacker could possibly use this issue to cause a denial of service or expose sensitive information. This     issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2018-17580, CVE-2018-17582)

    It was discovered that Tcpreplay incorrectly handled certain specially crafted packet capture input. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04     ESM and Ubuntu 18.04 ESM. (CVE-2018-17974, CVE-2018-18407)

    It was discovered that a use-after-free existed in Tcpreplay in the tcpbridge binary. An attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 ESM and Ubuntu     18.04 ESM. (CVE-2018-18408)

    It was discovered that Tcpreplay incorrectly handled certain specially crafted packet capture input. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04     ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2018-20552, CVE-2018-20553)

    It was discovered that a heap-based buffer over-read that existed in Tcpreplay caused an application crash     when tcprewrite or tcpreplay-edit received specially crafted packet capture input. An attacker could     possibly use this to cause a denial of service or to expose sensitive information. This issue only     affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12740)

    It was discovered that Tcpreplay incorrectly handled certain specially crafted packet capture input when     processed by tcpprep. An attacker could possibly use this issue to cause a denial of service. This issue     only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-24265, CVE-2020-24266)

    It was discovered that Tcpreplay incorrectly handled certain specially crafted packet capture input when     processed by tcprewrite. An attacker could possibly use this issue to cause a denial of service. This     issue only affected Ubuntu 22.04 ESM. (CVE-2022-27416)

    It was discovered that Tcpreplay did not properly manage memory under certain circumstances. If a user     were tricked into opening a specially crafted packet capture file, a remote attacker could possibly use     this issue to cause Tcpreplay crash, resulting in a denial of service, or possibly read sensitive data.
    This issue only affected Ubuntu 18.04 ESM, Ubuntu 20.04 ESM and Ubuntu 22.04 ESM. (CVE-2022-28487)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202210-08 (Tcpreplay: Multiple Vulnerabilities)

  - tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv6() at tree.c (CVE-2021-45386)

  - tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv4() at tree.c. (CVE-2021-45387)

  - Tcpreplay v4.4.1 was discovered to contain a double-free via __interceptor_free. (CVE-2022-27416)

  - Tcpreplay v4.4.1 has a heap-based buffer overflow in do_checksum_math at /tcpedit/checksum.c.
    (CVE-2022-27418)

  - tcprewrite in Tcpreplay 4.4.1 has a reachable assertion in get_layer4_v6 in common/get.c. (CVE-2022-27939)

  - tcprewrite in Tcpreplay 4.4.1 has a heap-based buffer over-read in get_ipv6_next in common/get.c.
    (CVE-2022-27940)

  - tcprewrite in Tcpreplay 4.4.1 has a heap-based buffer over-read in get_l2len_protocol in common/get.c.
    (CVE-2022-27941)

  - tcpprep in Tcpreplay 4.4.1 has a heap-based buffer over-read in parse_mpls in common/get.c.
    (CVE-2022-27942)

  - Tcpreplay version 4.4.1 contains a memory leakage flaw in fix_ipv6_checksums() function. The highest     threat from this vulnerability is to data confidentiality. (CVE-2022-28487)

  - The component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in     get_ipv6_next at common/get.c:713. NOTE: this is different from CVE-2022-27940. (CVE-2022-37047)

  - The component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in     get_l2len_protocol at common/get.c:344. NOTE: this is different from CVE-2022-27941. (CVE-2022-37048)

  - The component tcpprep in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in     parse_mpls at common/get.c:150. NOTE: this is different from CVE-2022-27942. (CVE-2022-37049)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
183169	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : Tcpreplay vulnerabilities (USN-5205-1)	Nessus	Ubuntu Local Security Checks	critical
166164	GLSA-202210-08 : Tcpreplay: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2022-27416

high

Tenable Plugins

critical

high