Wireshark up to 2.6.6 ASN.1 BER Dissector packet-ber.c Packet memory corruption

Summaryinfo

A vulnerability was found in Wireshark. It has been rated as critical. Affected by this vulnerability is an unknown functionality of the file epan/dissectors/packet-ber.c of the component ASN.1 BER Dissector. The manipulation as part of Packet leads to memory corruption. This vulnerability is referenced as CVE-2019-9209. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Wireshark (Packet Analyzer Software). This issue affects an unknown function of the file epan/dissectors/packet-ber.c of the component ASN.1 BER Dissector. The manipulation as part of a Packet leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the ASN.1 BER and related dissectors could crash. This was addressed in epan/dissectors/packet-ber.c by preventing a buffer overflow associated with excessive digits in time values.

The bug was discovered 02/27/2019. The weakness was published 02/28/2019 by Mateusz Jurczyk (OSS-Fuzz) (Website). The advisory is shared at securityfocus.com. The identification of this vulnerability is CVE-2019-9209 since 02/26/2019. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 371670 (Wireshark Multiple Vulnerabilities (wnpa-sec-2019-06 to wnpa-sec-2019-08)).

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 107203†). Similar entries are available at VDB-131284, VDB-131286 and VDB-133145. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Packet Analyzer Software

Name

• Wireshark

Version

• 2.4.0
• 2.4.1
• 2.4.2
• 2.4.3
• 2.4.4
• 2.4.5
• 2.4.6
• 2.4.7
• 2.4.8
• 2.4.9
• 2.4.10
• 2.4.11
• 2.4.12
• 2.6.0
• 2.6.1
• 2.6.2
• 2.6.3
• 2.6.4
• 2.6.5
• 2.6.6

License

• open-source

Website

• Product: https://www.wireshark.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion