SB2026072436 - Multiple vulnerabilities in Tcpreplay

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072436

SB2026072436 - Multiple vulnerabilities in Tcpreplay

Published: July 24, 2026 Updated: July 24, 2026

Security Bulletin ID SB2026072436
CSH Severity
High
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

High 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the get_layer4_v6 function. A remote attacker can trigger an out-of-bounds read error and read contents of memory on the system or perform a denialo f service (DoS) attack..


2) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the tcprewrite fragroute rules parser in mod_open() when parsing an empty or comment-only fragroute rules file. A local user can provide a crafted fragroute rules file to cause a denial of service.

Exploitation requires tcprewrite to be built with libdnet/fragroute support and invoked with the --fragroute option. The write occurs during startup before any packet is processed.


3) Off-by-one (CVE-ID: N/A)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an off-by-one heap-based buffer overflow in the tcp_chaff fragroute module when processing an attacker-influenced fragroute rules file with a tcp_chaff directive. A remote user can supply a crafted rules file to cause a denial of service.

Exploitation requires tcprewrite to be built with libdnet/fragroute support and invoked with the --fragroute option against a pcap containing TCP traffic with payload data and the ACK flag set.


4) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to out-of-bounds write in the tcprewrite fragroute rules parser in mod_open() when parsing a supplied fragroute rules file. A remote attacker can supply a specially crafted rules file to execute arbitrary code.

User interaction is required to open or process the crafted rules file, and the issue is triggered during startup before any packet is processed. Only builds with fragroute support enabled are vulnerable.


5) Off-by-one (CVE-ID: N/A)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to corrupt heap memory and cause a denial of service.

The vulnerability exists due to an off-by-one heap-based buffer overflow in the ip_chaff fragroute module when processing an attacker-influenced fragroute rules file via tcprewrite's --fragroute feature. A remote attacker can supply a rules file containing an ip_chaff directive to corrupt heap memory and cause a denial of service.

Exploitation requires tcprewrite to be built with libdnet/fragroute support and operates on an ordinary IPv4 pcap without requiring crafted packet content.


6) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.

The vulnerability exists due to out-of-bounds write in tcprewrite fragroute tcp_seg and ip_frag modules when parsing a negative size value from an attacker-influenced fragroute rules file. A remote attacker can supply a specially crafted rules file to execute arbitrary code or cause a denial of service.

Exploitation requires tcprewrite to be built with libdnet fragroute support and invoked with the --fragroute option. No crafted packet content is required.


Remediation

Install update from vendor's website.

References