Input validation error in Wireshark

1) Input validation error

EUVDB-ID: #VU32364

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2015-7830

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The pcapng_read_if_descr_block function in wiretap/pcapng.c in the pcapng parser in Wireshark 1.12.x before 1.12.8 uses too many levels of pointer indirection, which allows remote attackers to cause a denial of service (incorrect free and application crash) via a crafted packet that triggers interface-filter copying.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.12.0 - 1.12.7

CPE2.3

• cpe:2.3:a:wireshark_org:wireshark:1.12.0:*:*:*:*:*:*:*
• cpe:2.3:a:wireshark_org:wireshark:1.12.1:*:*:*:*:*:*:*
• cpe:2.3:a:wireshark_org:wireshark:1.12.2:*:*:*:*:*:*:*
• cpe:2.3:a:wireshark_org:wireshark:1.12.3:*:*:*:*:*:*:*
• cpe:2.3:a:wireshark_org:wireshark:1.12.4:*:*:*:*:*:*:*
• cpe:2.3:a:wireshark_org:wireshark:1.12.5:*:*:*:*:*:*:*
• cpe:2.3:a:wireshark_org:wireshark:1.12.6:*:*:*:*:*:*:*
• cpe:2.3:a:wireshark_org:wireshark:1.12.7:*:*:*:*:*:*:*

External links

https://lists.opensuse.org/opensuse-updates/2015-10/msg00053.html
https://www.debian.org/security/2016/dsa-3505
https://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
https://www.securityfocus.com/bid/77101
https://www.securityfocus.com/bid/78723
https://www.securitytracker.com/id/1033953
https://www.wireshark.org/security/wnpa-sec-2015-30.html
https://www.zerodayinitiative.com/advisories/ZDI-15-624
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11455
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=72497918b16b706c3ba75e1f731f58b802ca14d1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.