CVE-2025-51005
📋 TL;DR
A heap buffer overflow vulnerability in tcpliveplay utility of tcpreplay 4.5.1 allows attackers to cause denial of service by processing a malicious pcap file. The vulnerability occurs during checksum calculation and can crash the application. Anyone using tcpliveplay to replay network traffic is affected.
💻 Affected Systems
- tcpreplay
📦 What is this software?
Tcpreplay by Broadcom
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if combined with other vulnerabilities, though this is not directly indicated by the CWE-122 description.
Likely Case
Denial of service through application crash when processing malicious pcap files.
If Mitigated
Limited to application crash without system compromise if proper memory protections are enabled.
🎯 Exploit Status
Exploitation requires local or remote access to feed malicious pcap files to tcpliveplay. Proof of concept available in GitHub references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check tcpreplay GitHub repository for latest version
Vendor Advisory: https://github.com/appneta/tcpreplay/issues/925
Restart Required: No
Instructions:
1. Check current version with 'tcpliveplay --version'. 2. Update tcpreplay from official repository. 3. Recompile if using source. 4. Replace existing tcpliveplay binary.
🔧 Temporary Workarounds
Disable tcpliveplay usage
linuxRemove execute permissions or restrict access to tcpliveplay binary
chmod -x /usr/bin/tcpliveplay
chmod 000 /usr/bin/tcpliveplay
Input validation
allOnly process pcap files from trusted sources
🧯 If You Can't Patch
- Restrict tcpliveplay execution to trusted users only
- Implement strict file validation for pcap inputs
🔍 How to Verify
Check if Vulnerable:
Check if tcpliveplay version is 4.5.1 with 'tcpliveplay --version'Check Version:
tcpliveplay --versionVerify Fix Applied:
Verify updated version no longer crashes with test pcap files📡 Detection & Monitoring
Log Indicators:
- Segmentation fault logs from tcpliveplay
- Abnormal process termination
Network Indicators:
- Unusual pcap file transfers to systems running tcpreplay
SIEM Query:
process_name:"tcpliveplay" AND (event_type:"crash" OR exit_code:139)