Wireshark up to 3.2.1 RRC Dissector packet-lte-rrc.c Packet resource consumption

Summaryinfo

A vulnerability marked as problematic has been reported in Wireshark. Affected is an unknown function of the file epan/dissectors/packet-lte-rrc.c of the component RRC Dissector. This manipulation as part of Packet causes resource consumption. This vulnerability is handled as CVE-2020-9431. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Wireshark (Packet Analyzer Software). It has been declared as critical. Affected by this vulnerability is an unknown code of the file epan/dissectors/packet-lte-rrc.c of the component RRC Dissector. The manipulation as part of a Packet leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. The summary by CVE is:

In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory. This was addressed in epan/dissectors/packet-lte-rrc.c by adjusting certain append operations.

The weakness was released 02/27/2020. This vulnerability is known as CVE-2020-9431 since 02/27/2020. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-150719, VDB-150718 and VDB-150720. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Packet Analyzer Software

Name

• Wireshark

Version

• 2.6.0
• 2.6.1
• 2.6.2
• 2.6.3
• 2.6.4
• 2.6.5
• 2.6.6
• 2.6.7
• 2.6.8
• 2.6.9
• 2.6.10
• 2.6.11
• 2.6.12
• 2.6.13
• 2.6.14
• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.2.0
• 3.2.1

License

• open-source

Website

• Product: https://www.wireshark.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion