Tcpflow
Monthly
Denial-of-service attacks against tcpflow up to version 1.61 are possible via malformed 802.11 management frames that trigger a stack-based buffer overflow in TIM element parsing. An unauthenticated remote attacker can craft a specially designed wireless frame to cause a one-byte out-of-bounds write, crashing the application or potentially executing arbitrary code. Public exploit code exists, but no patches are currently available for affected Debian Linux systems and other distributions using vulnerable tcpflow versions.
Out-of-bounds memory read in tcpflow through 1.6.1 allows unauthenticated remote attackers to leak process memory into reconstructed flow files or crash the tool by supplying TCP packets whose IP payload-length field is forged to disagree with the actual packet size. The flaw is reachable in two ways: injecting crafted IPv4 or IPv6 TCP packets into traffic a tcpflow instance is capturing live, or handing an operator a malicious pcap file to process; both require that someone actually runs tcpflow over the attacker-influenced input, which is the primary limiting factor (CVSS 4.0 AT:P, 6.3 medium; independently assessed as CVSS 3.1 6.3 with low confidentiality and low availability impact only). Exploitation is not confirmed in the wild and no CISA KEV entry exists; a public technical writeup describing the payload-length forgery is referenced, but it is not verified as working exploit code, and the vuln.today priority decision is this_month rather than immediate action.
A stack-based buffer over-read exists in setbit() at iptree.h of TCPFLOW 1.5.0, due to received incorrect values causing incorrect computation, leading to denial of service during an. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in wifipcap/wifipcap.cpp in TCPFLOW through 1.5.0-alpha. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Denial-of-service attacks against tcpflow up to version 1.61 are possible via malformed 802.11 management frames that trigger a stack-based buffer overflow in TIM element parsing. An unauthenticated remote attacker can craft a specially designed wireless frame to cause a one-byte out-of-bounds write, crashing the application or potentially executing arbitrary code. Public exploit code exists, but no patches are currently available for affected Debian Linux systems and other distributions using vulnerable tcpflow versions.
Out-of-bounds memory read in tcpflow through 1.6.1 allows unauthenticated remote attackers to leak process memory into reconstructed flow files or crash the tool by supplying TCP packets whose IP payload-length field is forged to disagree with the actual packet size. The flaw is reachable in two ways: injecting crafted IPv4 or IPv6 TCP packets into traffic a tcpflow instance is capturing live, or handing an operator a malicious pcap file to process; both require that someone actually runs tcpflow over the attacker-influenced input, which is the primary limiting factor (CVSS 4.0 AT:P, 6.3 medium; independently assessed as CVSS 3.1 6.3 with low confidentiality and low availability impact only). Exploitation is not confirmed in the wild and no CISA KEV entry exists; a public technical writeup describing the payload-length forgery is referenced, but it is not verified as working exploit code, and the vuln.today priority decision is this_month rather than immediate action.
A stack-based buffer over-read exists in setbit() at iptree.h of TCPFLOW 1.5.0, due to received incorrect values causing incorrect computation, leading to denial of service during an. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in wifipcap/wifipcap.cpp in TCPFLOW through 1.5.0-alpha. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.