Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Fedora 24: 2017-936a79ee30 Critical: Tcpreplay Buffer Overflow

fedora
Calendar Grey March 16, 2017
Dist Fedora Esm H88
Fedora 24 release fixes a security vulnerability in Tcpreplay's tcpcapinfo tool by implementing a patch for CVE-2017-6429.
Patch CVE-2017-6429

Summary

Tcpreplay is a tool to replay captured network traffic. Currently, tcpreplay

supports pcap (tcpdump) and snoop capture formats. Also included, is tcpprep

a tool to pre-process capture files to allow increased performance under

certain conditions as well as capinfo which provides basic information about

capture files.

Update Information:

Patch CVE-2017-6429. Tcpcapinfo utility of Tcpreplay has a buffer overflow vulnerability associated with parsing a crafted pcap file. This occurs in the src/tcpcapinfo.c file when capture has a packet that is too large to handle.

Topics%20covered

Topics Covered

security advisory security issue buffer overflow Fedora patch tcpreplay network replay

Change Log

References

https://github.com/appneta/tcpreplay/issues/278
[ 1 ] Bug #1429521 - CVE-2017-6429 tcpreplay: Buffer overflow in Tcpcapinfo utility [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1429521 [ 2 ] Bug #1429522 - CVE-2017-6429 tcpreplay: Buffer overflow in Tcpcapinfo utility [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1429522

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade tcpreplay' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html

Severity
critical
Lowest
Low
Medium
High
Critical

Name: tcpreplay
Product: Fedora 24
Version: 4.1.2
Release: 3.fc24
URL: http://tcpreplay.appneta.com/
Summary: Replay captured network traffic

Topics%20covered

Topics Covered

security advisory security issue buffer overflow Fedora patch tcpreplay network replay

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here