CVE-2019-8376: Null Pointer Dereference
First published: Sun Feb 17 2019(Updated: )
An issue was discovered in Tcpreplay 4.3.1. A NULL pointer dereference occurred in the function get_layer4_v6() located at get.c. This can be triggered by sending a crafted pcap file to the tcpreplay-edit binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Broadcom Tcpreplay | =4.3.1 | |
| Fedoraproject Fedora | =28 | |
| Fedoraproject Fedora | =29 | |
| Fedoraproject Fedora | =30 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/107085
- https://github.com/appneta/tcpreplay/issues/537
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4V3SADKXUSHWTVAPU3WLXBDEQUHRA6ZO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EB3ASS7URTIA3IFSBL2DIWJAFKTBJCAW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLPY6W7Z7G6PF2JN4LXXHCACYLD4RBG6/
- https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-in-function-get_layer4_v6-tcpreplay-4-3-1/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MLPY6W7Z7G6PF2JN4LXXHCACYLD4RBG6/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V3SADKXUSHWTVAPU3WLXBDEQUHRA6ZO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EB3ASS7URTIA3IFSBL2DIWJAFKTBJCAW/
Frequently Asked Questions
What is CVE-2019-8376?
CVE-2019-8376 is a vulnerability in Tcpreplay 4.3.1 that allows an attacker to cause a Denial of Service (Segmentation fault) or potentially have other impacts.
How severe is CVE-2019-8376?
CVE-2019-8376 has a severity score of 7.8 (High).
How does CVE-2019-8376 affect the affected software?
CVE-2019-8376 affects Tcpreplay 4.3.1 and possibly certain versions of Fedoraproject Fedora.
How can the NULL pointer dereference vulnerability in Tcpreplay 4.3.1 be triggered?
The NULL pointer dereference vulnerability in Tcpreplay 4.3.1 can be triggered by sending a crafted pcap file to the tcpreplay-edit binary.
Are there any fixes or patches available for CVE-2019-8376?
Please refer to the provided references for information on available fixes or patches for CVE-2019-8376.
- collector/nvd-index
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/broadcom
- canonical/broadcom tcpreplay
- version/broadcom tcpreplay/4.3.1
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/28
- version/fedoraproject fedora/29
- version/fedoraproject fedora/30