search

appneta / tcpreplay

Pcap editing and replay tools for *NIX and Windows - Users please download source from
http://tcpreplay.appneta.com/wiki/installation.html#downloads
1.16k stars 268 forks source link

[Bug] Format string vulnerability in fix_ipv6_checksums() function #723

Closed tin-z closed 1 year ago

tin-z commented 2 years ago

Describe the bug Tcpreplay version 4.4.1 contains a memory leakage flaw, CWE-134 vulnerability in fix_ipv6_checksums() function. The highest threat from this vulnerability is to data confidentiality. The inputs required to exploit the vulnerability is unknown.

https://github.com/appneta/tcpreplay/blob/09f07748dcabe3d58961f123f31dd0f75198a389/src/tcpedit/edit_packet.c#L160-L166

Additional context A patch was proposed in the following pull request: https://github.com/appneta/tcpreplay/pull/720

fklassen commented 1 year ago

Fixed in PR #720