SB2012092011 - Division by zero in wireshark (Alpine package)
Published: September 20, 2012
Security Bulletin ID
SB2012092011
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Partial DoS
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Division by zero (CVE-ID: CVE-2012-4285)
CWE-ID: CWE-369 - Divide By Zero
CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to divide-by-zero error within The dissect_pft function in epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2. A remote attacker can perform a denial of service (divide-by-zero error and application crash) via a zero-length message.
Remediation
Install update from vendor's website.