Vulnerability Details : CVE-2019-8381
Potential exploit
An issue was discovered in Tcpreplay 4.3.1. An invalid memory access occurs in do_checksum in checksum.c. It can be triggered by sending a crafted pcap file to the tcpreplay-edit binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Vulnerability category: OverflowMemory CorruptionDenial of service
Products affected by CVE-2019-8381
- cpe:2.3:a:broadcom:tcpreplay:4.3.1:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-8381
0.23%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 46 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-8381
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2019-8381
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-8381
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EB3ASS7URTIA3IFSBL2DIWJAFKTBJCAW/
[SECURITY] Fedora 30 Update: tcpreplay-4.3.2-1.fc30 - package-announce - Fedora Mailing-ListsMailing List;Release Notes;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLPY6W7Z7G6PF2JN4LXXHCACYLD4RBG6/
[SECURITY] Fedora 28 Update: tcpreplay-4.3.2-1.fc28 - package-announce - Fedora Mailing-ListsMailing List;Release Notes;Third Party Advisory
-
https://github.com/appneta/tcpreplay/issues/538
Invalid memory access in do_checksum() · Issue #538 · appneta/tcpreplay · GitHubExploit;Issue Tracking;Third Party Advisory
-
https://research.loginsoft.com/bugs/invalid-memory-access-vulnerability-in-function-do_checksum-tcpreplay-4-3-1/
CVE-2019-8381: Invalid memory access Vulnerability in function do_checksum() - tcpreplay-4.3.1 - Loginsoft ResearchExploit;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4V3SADKXUSHWTVAPU3WLXBDEQUHRA6ZO/
[SECURITY] Fedora 29 Update: tcpreplay-4.3.2-1.fc29 - package-announce - Fedora Mailing-ListsMailing List;Release Notes;Third Party Advisory
Jump to