Multiple vulnerabilities in Wireshark



| Updated: 2022-03-24
Risk Medium
Patch available YES
Number of vulnerabilities 9
CVE-ID CVE-2013-4936
CVE-2013-4921
CVE-2013-4922
CVE-2013-4923
CVE-2013-4924
CVE-2013-4925
CVE-2013-4926
CVE-2013-4928
CVE-2013-4920
CWE-ID CWE-20
CWE-399
CWE-401
CWE-119
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Wireshark
Server applications / IDS/IPS systems, Firewalls and proxy servers

Vendor Wireshark.org

Security Bulletin

This security bulletin contains information about 9 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU42687

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-4936

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows remote attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (NULL pointer dereference and application crash) via a crafted packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.10.0

CPE2.3 External links

https://anonsvn.wireshark.org/viewvc/trunk/plugins/profinet/packet-pn-rt.c?r1=50651&r2=50650&pathrev=50651
https://anonsvn.wireshark.org/viewvc?view=revision&revision=50651
https://secunia.com/advisories/54296
https://secunia.com/advisories/54425
https://www.gentoo.org/security/en/glsa/glsa-201308-05.xml
https://www.wireshark.org/docs/relnotes/wireshark-1.10.1.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8904
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16971
https://www.wireshark.org/security/wnpa-sec-2013-53.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU42688

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-4921

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Off-by-one error in the dissect_radiotap function in epan/dissectors/packet-ieee80211-radiotap.c in the Radiotap dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (application crash) via a crafted packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.10.0

CPE2.3 External links

https://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-ieee80211-radiotap.c?r1=50090&r2=50089&pathrev=50090
https://anonsvn.wireshark.org/viewvc?view=revision&revision=50090
https://secunia.com/advisories/54296
https://secunia.com/advisories/54425
https://www.gentoo.org/security/en/glsa/glsa-201308-05.xml
https://www.wireshark.org/docs/relnotes/wireshark-1.10.1.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8830
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17514
https://www.wireshark.org/security/wnpa-sec-2013-43.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Resource management error

EUVDB-ID: #VU42689

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-4922

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Double free vulnerability in the dissect_dcom_ActivationProperties function in epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (application crash) via a crafted packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.10.0

CPE2.3 External links

https://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dcom-sysact.c?r1=50094&r2=50093&pathrev=50094
https://anonsvn.wireshark.org/viewvc?view=revision&revision=50094
https://secunia.com/advisories/54296
https://secunia.com/advisories/54425
https://www.gentoo.org/security/en/glsa/glsa-201308-05.xml
https://www.wireshark.org/docs/relnotes/wireshark-1.10.1.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8828
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17456
https://www.wireshark.org/security/wnpa-sec-2013-44.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Memory leak

EUVDB-ID: #VU42690

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-4923

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the dissect_dcom_ActivationProperties function in epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (memory consumption) via crafted packets. A remote attacker can perform a denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.10.0

CPE2.3 External links

https://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dcom-sysact.c?r1=50094&r2=50093&pathrev=50094
https://anonsvn.wireshark.org/viewvc?view=revision&revision=50094
https://secunia.com/advisories/54296
https://secunia.com/advisories/54425
https://www.gentoo.org/security/en/glsa/glsa-201308-05.xml
https://www.wireshark.org/docs/relnotes/wireshark-1.10.1.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8828
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16731
https://www.wireshark.org/security/wnpa-sec-2013-44.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Input validation error

EUVDB-ID: #VU42691

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-4924

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 does not properly validate certain index values, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.10.0

CPE2.3 External links

https://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dcom-sysact.c?r1=50432&r2=50431&pathrev=50432
https://anonsvn.wireshark.org/viewvc?view=revision&revision=50432
https://secunia.com/advisories/54296
https://secunia.com/advisories/54425
https://www.gentoo.org/security/en/glsa/glsa-201308-05.xml
https://www.wireshark.org/docs/relnotes/wireshark-1.10.1.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8828
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17701
https://www.wireshark.org/security/wnpa-sec-2013-44.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Input validation error

EUVDB-ID: #VU42692

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-4925

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Integer signedness error in epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.10.0

CPE2.3 External links

https://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dcom-sysact.c?r1=50478&r2=50477&pathrev=50478
https://anonsvn.wireshark.org/viewvc?view=revision&revision=50478
https://secunia.com/advisories/54296
https://secunia.com/advisories/54425
https://www.gentoo.org/security/en/glsa/glsa-201308-05.xml
https://www.wireshark.org/docs/relnotes/wireshark-1.10.1.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8828
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17585
https://www.wireshark.org/security/wnpa-sec-2013-44.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Input validation error

EUVDB-ID: #VU42693

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-4926

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 does not properly determine whether there is remaining packet data to process, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.10.0

CPE2.3 External links

https://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dcom-sysact.c?r1=50478&r2=50477&pathrev=50478
https://anonsvn.wireshark.org/viewvc?view=revision&revision=50478
https://secunia.com/advisories/54296
https://secunia.com/advisories/54425
https://www.gentoo.org/security/en/glsa/glsa-201308-05.xml
https://www.wireshark.org/docs/relnotes/wireshark-1.10.1.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8828
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17547
https://www.wireshark.org/security/wnpa-sec-2013-44.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Input validation error

EUVDB-ID: #VU42694

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-4928

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Integer signedness error in the dissect_headers function in epan/dissectors/packet-btobex.c in the Bluetooth OBEX dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.10.0

CPE2.3 External links

https://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-btobex.c?r1=50258&r2=50257&pathrev=50258
https://anonsvn.wireshark.org/viewvc?view=revision&revision=50258
https://secunia.com/advisories/54296
https://secunia.com/advisories/54425
https://www.gentoo.org/security/en/glsa/glsa-201308-05.xml
https://www.wireshark.org/docs/relnotes/wireshark-1.10.1.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8875
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17540
https://www.wireshark.org/security/wnpa-sec-2013-46.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Buffer overflow

EUVDB-ID: #VU42695

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-4920

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The P1 dissector in Wireshark 1.10.x before 1.10.1 does not properly initialize a global variable, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.10.0

CPE2.3 External links

https://anonsvn.wireshark.org/viewvc?view=revision&revision=50083
https://secunia.com/advisories/54296
https://secunia.com/advisories/54425
https://www.gentoo.org/security/en/glsa/glsa-201308-05.xml
https://www.wireshark.org/docs/relnotes/wireshark-1.10.1.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8826
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17089
https://www.wireshark.org/security/wnpa-sec-2013-42.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###