Vulnerability Details CVE-2013-2488
The DTLS dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 does not validate the fragment offset before invoking the reassembly state machine, which allows remote attackers to cause a denial of service (application crash) via a large offset value that triggers write access to an invalid memory location.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.039
EPSS Ranking 87.7%
CVSS Severity
CVSS v2 Score 5.0
References
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=48011
- http://lists.opensuse.org/opensuse-updates/2013-03/msg00065.html
- http://lists.opensuse.org/opensuse-updates/2013-03/msg00077.html
- http://secunia.com/advisories/52471
- http://www.debian.org/security/2013/dsa-2644
- http://www.wireshark.org/docs/relnotes/wireshark-1.6.14.html
- http://www.wireshark.org/docs/relnotes/wireshark-1.8.6.html
- http://www.wireshark.org/security/wnpa-sec-2013-22.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8380
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16672
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=48011
- http://lists.opensuse.org/opensuse-updates/2013-03/msg00065.html
- http://lists.opensuse.org/opensuse-updates/2013-03/msg00077.html
- http://secunia.com/advisories/52471
- http://www.debian.org/security/2013/dsa-2644
- http://www.wireshark.org/docs/relnotes/wireshark-1.6.14.html
- http://www.wireshark.org/docs/relnotes/wireshark-1.8.6.html
- http://www.wireshark.org/security/wnpa-sec-2013-22.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8380
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16672
Products affected by CVE-2013-2488
-
cpe:2.3:a:wireshark:wireshark:1.6.0
-
cpe:2.3:a:wireshark:wireshark:1.6.1
-
cpe:2.3:a:wireshark:wireshark:1.6.10
-
cpe:2.3:a:wireshark:wireshark:1.6.11
-
cpe:2.3:a:wireshark:wireshark:1.6.12
-
cpe:2.3:a:wireshark:wireshark:1.6.13
-
cpe:2.3:a:wireshark:wireshark:1.6.2
-
cpe:2.3:a:wireshark:wireshark:1.6.3
-
cpe:2.3:a:wireshark:wireshark:1.6.4
-
cpe:2.3:a:wireshark:wireshark:1.6.5
-
cpe:2.3:a:wireshark:wireshark:1.6.6
-
cpe:2.3:a:wireshark:wireshark:1.6.7
-
cpe:2.3:a:wireshark:wireshark:1.6.8
-
cpe:2.3:a:wireshark:wireshark:1.6.9
-
cpe:2.3:a:wireshark:wireshark:1.8.0
-
cpe:2.3:a:wireshark:wireshark:1.8.1
-
cpe:2.3:a:wireshark:wireshark:1.8.2
-
cpe:2.3:a:wireshark:wireshark:1.8.3
-
cpe:2.3:a:wireshark:wireshark:1.8.4
-
cpe:2.3:a:wireshark:wireshark:1.8.5
-
cpe:2.3:o:debian:debian_linux:7.0
-
cpe:2.3:o:opensuse:opensuse:11.4
-
cpe:2.3:o:opensuse:opensuse:12.1
-
cpe:2.3:o:opensuse:opensuse:12.2
-
cpe:2.3:o:opensuse:opensuse:12.3