Executive brief
tcpreplay is a suite of utilities used to edit and replay captured network traffic. A vulnerability in its tcprewrite tool allows an attacker to crash the application by providing a specially crafted, oversized network frame. This results in a denial of service, preventing users from processing or replaying network capture files.
Technical details
The tcprewrite utility within the tcpreplay suite contains a resource management error (CWE-399) where it fails to validate the size of incoming network frames against its internal compile-time limit of 65,535 bytes. When processing frames that exceed this limit—such as those captured on interfaces with a 65,536 MTU (e.g., Linux loopback)—the application suffers a segmentation fault. An attacker can exploit this by providing a malicious PCAP file or network stream containing oversized frames. The issue is resolved in version 4.1.2 by increasing the internal limit and implementing proper bounds checking.
Affected products
- Appneta tcpreplay before 4.1.2
- Broadcom tcpreplay before 4.1.2
- Debian tcpreplay 3.4.3-2, 3.4.4-2
Timeline
- 2016-07-02: disclosed: Initial report to Debian bug tracker
- 2016-07-03: patched: Fixed in Debian tcpreplay 3.4.4-3
- 2017-01-23: advisory: NVD publication date