PT-2022-19055 · Tcpreplay+4 · Tcpreplay+4

Tin-Z · Published 2022-05-04 · Updated 2022-11-30 · CVE-2022-28487

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tcpreplay version 4.4.1

Description The issue is a memory leakage flaw in the fix ipv6 checksums() function. This flaw poses the highest threat to data confidentiality.

Recommendations For Tcpreplay version 4.4.1, consider disabling the fix ipv6 checksums() function as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

ALT-PU-2022-3223

ALT-PU-2022-3236

ALT-PU-2022-3237

ALT-PU-2022-3245

CVE-2022-28487

MGASA-2022-0345

USN-5205-1

Affected Products

Alt Linux

Debian

Linuxmint

Tcpreplay

Ubuntu

References · 35

• 🔥 https://github.com/appneta/tcpreplay/issues/723 · Exploit
• https://github.com/appneta/tcpreplay/pull/720 · Patch
• https://ubuntu.com/security/CVE-2018-17974 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20553 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-28487 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18407 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/5B75AFRJUGOYHCFG2ZV2JKSUPA6MSCT5 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5205-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-27416 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-24266 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28487 · Security Note
• https://ubuntu.com/security/CVE-2020-12740 · Vendor Advisory
• https://security.gentoo.org/glsa/202210-08 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-28487 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5B75AFRJUGOYHCFG2ZV2JKSUPA6MSCT5 · Vendor Advisory