(https://nvd.nist.gov/vuln/detail/CVE-2019-8381): An issue was discovered in Tcpreplay 4.3.1. An invalid memory access occurs in do_checksum in checksum.c. It can be triggered by sending a crafted pcap file to the tcpreplay-edit binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact. Gentoo Security Padawan (domhnall)
Other issues awaiting CVE assignment: https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-in-function-get_ipv6_l4proto-tcpreplay-4-3-1/ https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-in-function-get_layer4_v6-tcpreplay-4-3-1/
Perhaps I should slow down a bit, apologies. These are the CVEs https://nvd.nist.gov/vuln/detail/CVE-2019-8377 An issue was discovered in Tcpreplay 4.3.1. A NULL pointer dereference occurred in the function get_ipv6_l4proto() located at get.c. This can be triggered by sending a crafted pcap file to the tcpreplay-edit binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact. https://nvd.nist.gov/vuln/detail/CVE-2019-8376 An issue was discovered in Tcpreplay 4.3.1. A NULL pointer dereference occurred in the function get_layer4_v6() located at get.c. This can be triggered by sending a crafted pcap file to the tcpreplay-edit binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dffabcbf5eaf67bbb49b27ea4bb9d7ca6158f343 commit dffabcbf5eaf67bbb49b27ea4bb9d7ca6158f343 Author: Jeroen Roovers <jer@gentoo.org> AuthorDate: 2019-03-12 21:12:04 +0000 Commit: Jeroen Roovers <jer@gentoo.org> CommitDate: 2019-03-12 21:13:01 +0000 net-analyzer/tcpreplay: Version 4.3.2 Bug: https://bugs.gentoo.org/678266 Package-Manager: Portage-2.3.62, Repoman-2.3.12 Signed-off-by: Jeroen Roovers <jer@gentoo.org> net-analyzer/tcpreplay/Manifest | 1 + net-analyzer/tcpreplay/tcpreplay-4.3.2.ebuild | 74 +++++++++++++++++++++++++++ 2 files changed, 75 insertions(+)
Maintainer(s), please advise if you are ready for stabilization or call for stabilization yourself.
@arches, please stabilize.
amd64 stable
x86 stable
tree is clean
