CVE-2013-4935 in Wireshark
Summary
by MITRE
The dissect_per_length_determinant function in epan/dissectors/packet-per.c in the ASN.1 PER dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not initialize a length field in certain abnormal situations, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/20/2021
The vulnerability identified as CVE-2013-4935 resides within the ASN.1 PER dissector component of Wireshark, specifically in the dissect_per_length_determinant function located in epan/dissectors/packet-per.c. This flaw affects versions 1.8.x prior to 1.8.9 and 1.10.x prior to 1.10.1, representing a critical denial of service vulnerability that can be exploited remotely. The issue manifests when processing malformed ASN.1 Protocol Encoding Rule packets where the dissector fails to properly initialize a critical length field during abnormal processing conditions.
The technical root cause of this vulnerability stems from improper memory initialization within the dissector's handling of length determinants in ASN.1 PER encoded packets. When Wireshark encounters malformed packets that trigger the dissect_per_length_determinant function, the length field remains uninitialized, leading to unpredictable behavior when the application attempts to process this uninitialized data. This uninitialized memory access creates a condition where the application may read garbage values or attempt to dereference invalid memory addresses, ultimately resulting in an application crash. The vulnerability aligns with CWE-457: Use of Uninitialized Variable, which is categorized under the broader class of memory safety issues in software development.
The operational impact of this vulnerability extends beyond simple service disruption as it enables remote attackers to execute denial of service attacks against Wireshark instances without requiring any authentication or specialized privileges. An attacker can craft a specially designed ASN.1 PER packet that, when processed by the vulnerable Wireshark version, will cause the application to crash and terminate unexpectedly. This makes the vulnerability particularly dangerous in network monitoring environments where Wireshark is deployed to analyze traffic, as it could be exploited to disrupt network analysis operations or potentially serve as a precursor to more sophisticated attacks. The attack vector is classified as remote and requires no user interaction, making it highly exploitable in networked environments where Wireshark is actively monitoring traffic.
Mitigation strategies for CVE-2013-4935 primarily focus on immediate version upgrades to patched releases of Wireshark, specifically versions 1.8.9 and 1.10.1 or later. Organizations should prioritize updating their Wireshark installations across all network monitoring systems to eliminate exposure to this vulnerability. Additionally, network administrators can implement temporary network segmentation or packet filtering rules to prevent the transmission of malformed ASN.1 packets to systems running vulnerable Wireshark versions. The ATT&CK framework categorizes this type of vulnerability under T1499.004: Endpoint Denial of Service, which emphasizes the importance of maintaining up-to-date network analysis tools and implementing proper input validation mechanisms. Security teams should also consider implementing intrusion detection systems that can identify and alert on anomalous packet patterns that may indicate exploitation attempts. Regular vulnerability assessments and penetration testing should be conducted to ensure that network analysis tools remain secure against similar memory safety issues that could potentially lead to more severe exploitation outcomes.