Summaryinfo

A vulnerability described as problematic has been identified in Wireshark. The affected element is the function cairo_image_surface_get_data of the component Cairo Graphics Library. Executing a manipulation can lead to null pointer dereference. This vulnerability is tracked as CVE-2014-5116. Moreover, an exploit is present.

Detailsinfo

A vulnerability was found in Wireshark (Packet Analyzer Software) (unknown version). It has been declared as problematic. This vulnerability affects the function cairo_image_surface_get_data of the component Cairo Graphics Library. The manipulation with an unknown input leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. As an impact it is known to affect availability. CVE summarizes:

The cairo_image_surface_get_data function in Cairo 1.10.2, as used in GTK+ and Wireshark, allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a large string.

The weakness was disclosed 05/16/2014 by Osanda Malith as Bug 9761 as not defined bug report (Bugzilla). The advisory is available at bugs.wireshark.org. This vulnerability was named CVE-2014-5116 since 07/29/2014. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details and also a public exploit are known.

A public exploit has been developed by Osanda Malith in Python and been published immediately after the advisory. It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept. The code used by the exploit is:

payload = "A" * 50000
file = open('exploit.txt', "w")
file.write(payload)
file.close()

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (95039), Exploit-DB (33384) and OSVDB (107083†). The entry VDB-13451 is pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Packet Analyzer Software

Name

• Wireshark

License

• open-source

Website

• Product: https://www.wireshark.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion