Wireshark up to 3.0.0 DOF Dissector packet-dof.c Packet resource management

Summaryinfo

A vulnerability was found in Wireshark. It has been classified as problematic. Affected by this issue is some unknown functionality of the file epan/dissectors/packet-dof.c of the component DOF Dissector. The manipulation as part of Packet leads to resource management. This vulnerability is referenced as CVE-2019-10896. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in Wireshark (Packet Analyzer Software). It has been rated as problematic. This issue affects an unknown code block of the file epan/dissectors/packet-dof.c of the component DOF Dissector. The manipulation as part of a Packet leads to a resource management vulnerability. Using CWE to declare the problem leads to CWE-399. Impacted is availability. The summary by CVE is:

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was addressed in epan/dissectors/packet-dof.c by properly handling generated IID and OID bytes.

The bug was discovered 04/08/2019. The weakness was published 04/09/2019 by Mateusz Jurczyk (OSS-Fuzz) (Website). The advisory is shared at securityfocus.com. The identification of this vulnerability is CVE-2019-10896 since 04/05/2019. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 371730 (Wireshark Multiple Security Vulnerabilities (wnpa-sec-2019-09 to wnpa-sec-2019-18)).

Applying the patch 441b6d9071d6341e58dfe10719375489c5b8e3f0 is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 107203†). Similar entries are available at VDB-131284, VDB-131285, VDB-131286 and VDB-133144. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Packet Analyzer Software

Name

• Wireshark

Version

• 2.4.0
• 2.4.1
• 2.4.2
• 2.4.3
• 2.4.4
• 2.4.5
• 2.4.6
• 2.4.7
• 2.4.8
• 2.4.9
• 2.4.10
• 2.4.11
• 2.4.12
• 2.4.13
• 2.6.0
• 2.6.1
• 2.6.2
• 2.6.3
• 2.6.4
• 2.6.5
• 2.6.6
• 2.6.7
• 3.0.0

License

• open-source

Website

• Product: https://www.wireshark.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion