tcpreplay 4.3.0 beta1 tcpbridge tcpbridge.c post_args use after free

Summaryinfo

A vulnerability was found in tcpreplay 4.3.0 beta1. It has been rated as critical. Affected is the function post_args of the file tcpbridge.c of the component tcpbridge. Performing a manipulation results in use after free. This vulnerability is known as CVE-2018-18408. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical has been found in tcpreplay 4.3.0 beta1. This affects the function post_args of the file tcpbridge.c of the component tcpbridge. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A use-after-free was discovered in the tcpbridge binary of Tcpreplay 4.3.0 beta1. The issue gets triggered in the function post_args() at tcpbridge.c, causing a denial of service or possibly unspecified other impact.

The bug was discovered 10/15/2018. The weakness was published 10/17/2018 (Website). The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2018-18408 since 10/16/2018. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 120955 (Fedora 29 : tcpreplay (2018-5f91054677)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Fedora Local Security Checks and running in the context l.

Upgrading eliminates this vulnerability. A possible mitigation has been published 3 months after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (120955). Similar entries are available at VDB-120264, VDB-124571, VDB-124573 and VDB-124774. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• tcpreplay

Version

• 4.3.0 beta1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion